CVE-2019-18345

NameCVE-2019-18345
DescriptionA reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2034-1, DSA-4582-1
Debian Bugs946343

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
davical (PTS)buster, buster (security)1.1.8-1+deb10u1fixed
bullseye1.1.10-1fixed
sid, trixie, bookworm1.1.12-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
davicalsourcejessie1.1.3.1-1+deb8u1DLA-2034-1
davicalsourcestretch1.1.5-1+deb9u1DSA-4582-1
davicalsourcebuster1.1.8-1+deb10u1DSA-4582-1
davicalsource(unstable)1.1.9.2-1946343

Notes

https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/
https://gitlab.com/davical-project/davical/commit/86a8ec5302b705cd11f0373eefbe2168799b277b
https://gitlab.com/davical-project/davical/commit/a3acb770ac6bc807feb2015b4eb10ab641322d19

Search for package or bug name: Reporting problems