Vulnerability in Coturn
CVE-2020-26262
Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that wh…
EPSS: 0.003 (50.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Coturn — versions < 4.5.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p (x_refsource_CONFIRM)
- github.com/coturn/coturn/commit/abfe1fd08d78baa0947d17dac0f7411c3d948e4d (x_refsource_MISC)
- github.com/coturn/coturn/blob/57180ab60afcaeb13537e69ae8cb8aefd8f3f546/ChangeLog (x_refsource_MISC)
- FEDORA-2021-dee141fc61 (vendor-advisory, x_refsource_FEDORA)
- FEDORA-2021-32d0068851 (vendor-advisory, x_refsource_FEDORA)
Frequently asked questions
- What is CVE-2020-26262?
- CVE-2020-26262 is a high-severity vulnerability in Coturn, classified under Unintended Proxy or Intermediary (Confused Deputy). CVSS score: 7.2/10. Published 2021-01-13.
- How severe is CVE-2020-26262?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2020-26262 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.