CVE-2018-4058

Severity Score

7.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.

Existe una vulnerabilidad explotable de configuración insegura por defecto en la funcionalidad del servidor TURN de coTURN, en versiones anteriores a la 4.5.0.9. Por defecto, el servidor TURN permite la reproducción de tráfico externo en la interfaz de bucle invertido de su propio host. Esto puede proporcionar acceso a otros servicios privados que se ejecutan en dicho host, lo que puede conducir a más ataques. Un atacante puede configurar un relay con una dirección de bucle invertido como peer en un servidor TURN afectado para desencadenar esta vulnerabilidad.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-01-02 CVE Reserved
2019-01-28 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (1)

URL	Tag	Source
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732	Mitigation

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Coturn Project Search vendor "Coturn Project"		Coturn Search vendor "Coturn Project" for product "Coturn"				< 4.5.0.9 Search vendor "Coturn Project" for product "Coturn" and version " < 4.5.0.9"		-		Affected