CVE-2017-18635: canonical ubuntu_linux

Modified

AliasesMGASA-2020-0374RHSA-2020:0754UBUNTU-CVE-2017-18635+5 more

Published 25-09-2019Last modified 05-08-2024

Vulnerability summary

CVE-2017-18635 is a medium (CVSS 6.1) vulnerability in canonical ubuntu_linux. EPSS estimates a 4.79% chance of exploitation in the next 30 days, higher than 91.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.1/10

010

Medium · v3.1 (NVD)

EPSS score

4.79%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2020:3247

Timeline

25-09-2019
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

CVSS metrics

6 scores · 5 sources · 3 versions

v3.16.1v3.06.1v2.04.3

EPSS trend

Probability

4.79%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.79% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (shielder.it)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products

novnc< 1:1.0.0-1 | < 1:0.4+dfsg+1+20131010+gitf68af8af3d-6+deb9u1 | < 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1
debian_linuxEOL8.0 | 9.0

Redhat2 products

openstack13
novnc< 0:1.1.0-2.el7ost

@novnc1 product

novnc< 0.6.2

Canonical1 product

ubuntu_linuxEOL16.04

Mageia1 product

novnc< 0.5.1-2.1.mga7

Novnc1 product

novnc< 0.6.2

Ubuntu1 product

novncAll versions (No fix recorded) | < 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1build0.16.04.1

7 vendors · 9 products

References

27 links

github.com/novnc/noVNC/issues/748X Refsource MISCPatchThird Party AdvisoryREPORTWEB
github.com/novnc/noVNC/releases/tag/v0.6.2X Refsource MISCRelease NotesThird Party AdvisoryARTICLEREPORTWEB
bugs.launchpad.net/horizon/+bug/1656435X Refsource MISCIssue TrackingThird Party AdvisoryREPORTWEB
github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13X Refsource MISCPatchThird Party AdvisoryREPORTWEB
lists.debian.org/debian-lts-announce/2019/10/msg00004.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB
www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack/X Refsource MISCExploitThird Party Advisory
github.com/ShielderSec/cve-2017-18635X Refsource MISCThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0754Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
usn.ubuntu.com/4522-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.debian.org/debian-lts-announce/2021/12/msg00024.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB

Show all 27 references