CVE-2019-18347

Name	CVE-2019-18347
Description	A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2034-1, DSA-4582-1
Debian Bugs	946343

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
davical (PTS)	bullseye	1.1.10-1	fixed
	sid, trixie, bookworm	1.1.12-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
davical	source	jessie	1.1.3.1-1+deb8u1	DLA-2034-1
davical	source	stretch	1.1.5-1+deb9u1	DSA-4582-1
davical	source	buster	1.1.8-1+deb10u1	DSA-4582-1
davical	source	(unstable)	1.1.9.2-1		946343

Notes

https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/
https://gitlab.com/davical-project/davical/commit/86a8ec5302b705cd11f0373eefbe2168799b277b
https://gitlab.com/davical-project/davical/commit/a3acb770ac6bc807feb2015b4eb10ab641322d19