Vulnerability Details : CVE-2017-18635
Potential exploit
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2017-18635
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:a:novnc:novnc:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-18635
2.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-18635
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2017-18635
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-18635
-
https://lists.debian.org/debian-lts-announce/2021/12/msg00024.html
[SECURITY] [DLA 2854-1] novnc security updateMailing List;Third Party Advisory
-
https://github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534
Use textContent instead of innerHTML · novnc/noVNC@6048299 · GitHubPatch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2019/10/msg00004.html
Mailing List;Third Party Advisory
-
https://github.com/novnc/noVNC/releases/tag/v0.6.2
Release v0.6.2 · novnc/noVNC · GitHubRelease Notes;Third Party Advisory
-
https://www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack/
Exploiting an old noVNC XSS (CVE-2017-18635) in OpenStack - ShielderExploit;Third Party Advisory
-
https://bugs.launchpad.net/horizon/+bug/1656435
Bug #1656435 “XSS in noVNC” : Bugs : OpenStack Dashboard (Horizon)Issue Tracking;Third Party Advisory
-
https://github.com/ShielderSec/cve-2017-18635
GitHub - ShielderSec/CVE-2017-18635: PoC for CVE-2017-18635Third Party Advisory
-
https://github.com/novnc/noVNC/issues/748
[Fixed] XSS Vulnerability in noVNC · Issue #748 · novnc/noVNC · GitHubPatch;Third Party Advisory
-
https://usn.ubuntu.com/4522-1/
USN-4522-1: noVNC vulnerability | Ubuntu security notices | UbuntuThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2020:0754
RHSA-2020:0754 - Security Advisory - Red Hat Customer PortalThird Party Advisory
Jump to