CVE-2017-18635 — Cross-site Scripting in Novnc

CWE-79 — Cross-site Scripting13 documents8 sources
Severity
6.1MEDIUMNVD
EPSS
8.3%
top 7.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
NovncCanonical Ubuntu LinuxDebian Linux+1 more
Timeline
PublishedSep 25
Latest updateSep 21

Description

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

▶NVDnovnc/novnc< 0.6.2
▶npmnovnc/novnc< 0.6.2
▶Debiannovnc/novnc< 1:1.0.0-1+3
▶Ubuntunovnc/novnc< 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1build0.16.04.1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 16.04

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
novnc vulnerability↗2020-09-21
▶
OSV
Cross-Site Scripting in @novnc/novnc↗2020-08-28
▶
GHSA
Cross-Site Scripting in @novnc/novnc↗2020-08-28
▶
OSV
CVE-2017-18635: An XSS vulnerability was discovered in noVNC before 0↗2019-09-25
▶
CVEList
CVE-2017-18635: An XSS vulnerability was discovered in noVNC before 0↗2019-09-25
▶

📋Vendor Advisories

3
Ubuntu
noVNC vulnerability↗2020-09-21
▶
Red Hat
novnc: XSS vulnerability via the messages propagated to the status field↗2019-01-12
▶
Debian
CVE-2017-18635: novnc - An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VN...↗2017
▶

💬Community

4
Bugzilla
CVE-2017-18635 novnc: XSS vulnerability via the messages propagated to the status field [fedora-all]↗2019-10-25
▶
Bugzilla
CVE-2017-18635 novnc: XSS vulnerability via the messages propagated to the status field [openstack-rdo]↗2019-10-25
▶
Bugzilla
CVE-2017-18635 novnc: XSS vulnerability via the messages propagated to the status field [epel-all]↗2019-10-25
▶
Bugzilla
CVE-2017-18635 novnc: XSS vulnerability via the messages propagated to the status field↗2019-10-25
▶
CVE-2017-18635 — Cross-site Scripting in Novnc | cvebase