CVE-2019-18347: XSS
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18347?
CVE-2019-18347 is classified as a moderate severity vulnerability due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2019-18347?
To fix CVE-2019-18347, update DAViCal to version 1.1.10 or later, which addresses the cross-site scripting issue.
What versions of DAViCal are affected by CVE-2019-18347?
CVE-2019-18347 affects DAViCal versions up to and including 1.1.8.
Who can exploit CVE-2019-18347?
CVE-2019-18347 can be exploited by unprivileged users who can input untrusted data into vulnerable fields.
What type of vulnerability is CVE-2019-18347?
CVE-2019-18347 is a stored cross-site scripting (XSS) vulnerability that allows malicious scripts to be executed in the context of other users.