CVE-2019-18345

Name	CVE-2019-18345
Description	A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2034-1, DSA-4582-1
Debian Bugs	946343

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
davical (PTS)	bullseye	1.1.10-1	fixed
	sid, trixie, bookworm	1.1.12-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
davical	source	jessie	1.1.3.1-1+deb8u1	DLA-2034-1
davical	source	stretch	1.1.5-1+deb9u1	DSA-4582-1
davical	source	buster	1.1.8-1+deb10u1	DSA-4582-1
davical	source	(unstable)	1.1.9.2-1		946343

Notes

https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/
https://gitlab.com/davical-project/davical/commit/86a8ec5302b705cd11f0373eefbe2168799b277b
https://gitlab.com/davical-project/davical/commit/a3acb770ac6bc807feb2015b4eb10ab641322d19