CVE-2017-18635

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-09-25 · updated 2026-06-17
Weakness: CWE-79

Description

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Affected products

Canonical Ubuntu Linux: 16.04
Debian Linux: 8.0, 9.0
Novnc: before 0.6.2 — fixed in 0.6.2
OpenStack: 13

How to fix

Upgrade to a fixed version: Novnc 0.6.2. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2020:0754
https://bugs.launchpad.net/horizon/+bug/1656435
https://github.com/ShielderSec/cve-2017-18635
https://github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534
https://github.com/novnc/noVNC/issues/748
https://github.com/novnc/noVNC/releases/tag/v0.6.2
https://lists.debian.org/debian-lts-announce/2019/10/msg00004.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00024.html
https://usn.ubuntu.com/4522-1/
https://www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack/
https://access.redhat.com/errata/RHSA-2020:0754
https://bugs.launchpad.net/horizon/+bug/1656435

Get alerted when CVE-2017-18635 or the next vulnerability affects your stack