Published: 25/09/2019 Updated: 06/04/2022

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

An XSS vulnerability exists in noVNC prior to 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Vulnerable Product	Search on Vulmon	Subscribe to Product
novnc novnc
debian debian linux 8.0
debian debian linux 9.0
canonical ubuntu linux 16.04
redhat openstack 13

Synopsis Moderate: novnc security update Type/Severity Security Advisory: Moderate Topic An updated novnc package that fixes one security issue is now available forRed Hat Enterprise Linux OpenStack Platform 130Red Hat Product Security has rated this update as having Moderate securityimpact A Common Vuln ...

Synopsis Important: RHV Manager (ovirt-engine) 44 security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic Updated ovirt-engine packages that fix several bugs and add various enhancements are now availableRed Hat Product Security has rated this update as having a security ...

PoC for CVE-2017-18635

cve-2017-18635 PoC for CVE-2017-18635 Full article: Exploiting an old noVNC XSS (CVE-2017-18635) in OpenStack

CWE-79 https://github.com/novnc/noVNC/releases/tag/v0.6.2 https://github.com/novnc/noVNC/issues/748 https://bugs.launchpad.net/horizon/+bug/1656435 https://github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534 https://lists.debian.org/debian-lts-announce/2019/10/msg00004.html https://www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack/https://github.com/ShielderSec/cve-2017-18635 https://access.redhat.com/errata/RHSA-2020:0754 https://usn.ubuntu.com/4522-1/https://lists.debian.org/debian-lts-announce/2021/12/msg00024.html https://access.redhat.com/errata/RHSA-2020:0754 https://nvd.nist.gov https://github.com/ShielderSec/cve-2017-18635

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2017-18635

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect