CVE-2017-18635
novnc: XSS vulnerability via the messages propagated to the status field
Severity Score
6.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
Se detectó una vulnerabilidad de tipo XSS en noVNC versiones anteriores a 0.6.2, en la que el servidor remoto VNC podía inyectar HTML arbitrario en la página web de noVNC por medio de los mensajes propagados hacia el campo status, tales como el nombre del servidor VNC.
An XSS vulnerability was discovered in noVNC in which arbitrary HTML could be injected into the noVNC web page. An attacker having access to a VNC server could use target host values in a crafted URL to gain access to secure information (such as VM tokens).
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-01-12 First Exploit
- 2019-09-25 CVE Reserved
- 2019-09-25 CVE Published
- 2024-08-05 CVE Updated
- 2024-09-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| https://bugs.launchpad.net/horizon/+bug/1656435 | Issue Tracking | |
| https://github.com/ShielderSec/cve-2017-18635 | Third Party Advisory | |
| https://github.com/novnc/noVNC/releases/tag/v0.6.2 | Release Notes | |
| https://lists.debian.org/debian-lts-announce/2019/10/msg00004.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2021/12/msg00024.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/ShielderSec/CVE-2017-18635 | 2019-10-19 | |
| https://github.com/ossf-cve-benchmark/CVE-2017-18635 | 2017-01-12 | |
| https://www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack | 2024-08-05 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534 | 2022-04-06 | |
| https://github.com/novnc/noVNC/issues/748 | 2022-04-06 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2020:0754 | 2022-04-06 | |
| https://usn.ubuntu.com/4522-1 | 2022-04-06 | |
| https://access.redhat.com/security/cve/CVE-2017-18635 | 2020-08-04 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1765660 | 2020-08-04 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Novnc Search vendor "Novnc" | Novnc Search vendor "Novnc" for product "Novnc" | < 0.6.2 Search vendor "Novnc" for product "Novnc" and version " < 0.6.2" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | esm |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 13 Search vendor "Redhat" for product "Openstack" and version "13" | - |
Affected
| ||||||