// For flags

CVE-2018-4059

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.

Existe una vulnerabilidad explotable de configuración insegura por defecto en la función del servidor TURN de coTURN, en versiones anteriores a la 4.5.0.9. Por defecto, el servidor TURN ejecuta un portal de administrador telnet no autenticado en la interfaz de bucle invertido. Esto puede proporcionar acceso de administrador a la configuración del servidor TURN, lo que puede conducir a ataques adicionales. Un atacante que puede obtener acceso al puerto telnet puede obtener acceso de administrador al servidor TURN.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-01-02 CVE Reserved
  • 2019-01-28 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Coturn Project
Search vendor "Coturn Project"
 Coturn
Search vendor "Coturn Project" for product "Coturn"
 < 4.5.0.9
Search vendor "Coturn Project" for product "Coturn" and version " < 4.5.0.9"
-
Affected