CVE-2019-18345
Description
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2019-18345 NameCVE-2019-18345 DescriptionA reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user…
CVE-2019-18345
| Name | CVE-2019-18345 |
| Description | A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2034-1, DSA-4582-1 |
| Debian Bugs | 946343 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| davical (PTS) | bullseye | 1.1.10-1 | fixed |
| bookworm | 1.1.12-2 | fixed | |
| trixie | 1.1.12-2.1 | fixed | |
| forky, sid | 1.1.13-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| davical | source | jessie | 1.1.3.1-1+deb8u1 | DLA-2034-1 | ||
| davical | source | stretch | 1.1.5-1+deb9u1 | DSA-4582-1 | ||
| davical | source | buster | 1.1.8-1+deb10u1 | DSA-4582-1 | ||
| davical | source | (unstable) | 1.1.9.2-1 | 946343 |
Notes
https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/
https://gitlab.com/davical-project/davical/commit/86a8ec5302b705cd11f0373eefbe2168799b277b
https://gitlab.com/davical-project/davical/commit/a3acb770ac6bc807feb2015b4eb10ab641322d19
Apply commands
https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/https://gitlab.com/davical-project/davical/commit/86a8ec5302b705cd11f0373eefbe2168799b277bhttps://gitlab.com/davical-project/davical/commit/a3acb770ac6bc807feb2015b4eb10ab641322d19OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 1.1.9.2-1 |
| sid | Fixed | 1.1.9.2-1 |
| forky | Fixed | 1.1.9.2-1 |
| bullseye | Fixed | 1.1.9.2-1 |
| bookworm | Fixed | 1.1.9.2-1 |
References
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.