CVE-2019-18345: XSS
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18345?
CVE-2019-18345 is classified as a high-severity vulnerability due to its potential for reflected XSS attacks.
How do I fix CVE-2019-18345?
To fix CVE-2019-18345, update DAViCal to the latest versions 1.1.8-1+deb10u1, 1.1.10-1, or 1.1.12-2.
Which software versions are affected by CVE-2019-18345?
CVE-2019-18345 affects DAViCal versions up to and including 1.1.8.
What type of vulnerability is CVE-2019-18345?
CVE-2019-18345 is a reflected cross-site scripting (XSS) vulnerability.
What happens if I am vulnerable to CVE-2019-18345?
If vulnerable to CVE-2019-18345, an attacker may be able to perform actions on behalf of a user and view sensitive data.