Weak password of selenium VNC

Moderate

fit2-zhao published GHSA-88vv-6rm4-59h9

Sep 26, 2023

Package

No package listed

Affected versions

<= 2.10.6 LTS

Patched versions

>= 2.10.7 LTS

Description

Description

Selenium VNC is using a weak password by default, attackers can login to vnc and obtain high permissions.

Solution

Upgrade selenium image to 4.10.0 and disable VNC by default.
System administrator can enable VNC manually, run VNC in view-only mode and set a complex password.
See:
metersphere/installer@35598ac
metersphere/installer@02dd31c

Severity

Moderate

4.6

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L