CVE-2019-18345

NameCVE-2019-18345
DescriptionA reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2034-1, DSA-4582-1
NVD severitymedium
Debian Bugs946343

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
davical (PTS)stretch (security), stretch1.1.5-1+deb9u1fixed
buster, buster (security)1.1.8-1+deb10u1fixed
bullseye, sid1.1.9.3-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
davicalsource(unstable)1.1.9.2-1946343
davicalsourcebuster1.1.8-1+deb10u1DSA-4582-1
davicalsourcejessie1.1.3.1-1+deb8u1DLA-2034-1
davicalsourcestretch1.1.5-1+deb9u1DSA-4582-1

Notes

https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/
https://gitlab.com/davical-project/davical/commit/86a8ec5302b705cd11f0373eefbe2168799b277b
https://gitlab.com/davical-project/davical/commit/a3acb770ac6bc807feb2015b4eb10ab641322d19

Search for package or bug name: Reporting problems