CVE-2018-4058
Last modified
CVE-2018-4058 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. EPSS estimates a 0.94% chance of exploitation in the next 30 days.
Description
An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Coturn Project | Coturn | < 4.5.0.9 |
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732Mitigation, Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732Mitigation, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-4058?
How severe is CVE-2018-4058?
How do I fix CVE-2018-4058?
Are you affected by CVE-2018-4058?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST