medium6.1
CVE-2017-18635
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages p…
Impact
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Novnc | Novnc | before 0.6.2 |
| Debian | Debian Linux | Versions 8.0, 9.0 |
| Canonical | Ubuntu Linux | Version 16.04 |
| Redhat | Openstack | Version 13 |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2020:0754
- https://bugs.launchpad.net/horizon/+bug/1656435
- https://github.com/ShielderSec/cve-2017-18635
- https://github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534
- https://github.com/novnc/noVNC/issues/748
- https://github.com/novnc/noVNC/releases/tag/v0.6.2
- https://lists.debian.org/debian-lts-announce/2019/10/msg00004.html
- https://lists.debian.org/debian-lts-announce/2021/12/msg00024.html
- https://usn.ubuntu.com/4522-1/
- https://www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack/
- https://access.redhat.com/errata/RHSA-2020:0754
- https://bugs.launchpad.net/horizon/+bug/1656435
- https://github.com/ShielderSec/cve-2017-18635
- https://github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534
- https://github.com/novnc/noVNC/issues/748
- https://github.com/novnc/noVNC/releases/tag/v0.6.2
- https://lists.debian.org/debian-lts-announce/2019/10/msg00004.html
- https://lists.debian.org/debian-lts-announce/2021/12/msg00024.html
- https://usn.ubuntu.com/4522-1/
- https://www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack/