CVE-2017-18635

MEDIUM6.1EPSS 6.5%

Cross-Site Scripting in @novnc/novnc

發布日:2020/8/28修改日:2023/11/8
也稱為:GHSA-49rv-g7w5-m8xxDEBIAN-CVE-2017-18635DLA-1946-1

描述

Versions of `@novnc/novnc` prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of `include/ui.js` and users of `vnc_auto.html` and `vnc.html`. ## Recommendation Upgrade to version 0.6.2 or later.

受影響套件(4)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

參考連結(15)