GHSA-49rv-g7w5-m8xx

Suggest an improvement
Source
https://github.com/advisories/GHSA-49rv-g7w5-m8xx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-49rv-g7w5-m8xx/GHSA-49rv-g7w5-m8xx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-49rv-g7w5-m8xx
Aliases
Published
2020-08-28T21:24:59Z
Modified
2023-11-08T03:59:16.468972Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-Site Scripting in @novnc/novnc
Details

Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of include/ui.js and users of vnc_auto.html and vnc.html.

Recommendation

Upgrade to version 0.6.2 or later.

Database specific 
{
    "nvd_published_at": "2019-09-25T23:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-28T21:21:28Z"
}
References

Affected packages

npm / @novnc/novnc

Package

Name
@novnc/novnc
View open source insights on deps.dev
Purl
pkg:npm/%40novnc/novnc

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.6.2