UBUNTU-CVE-2019-18345: XSS
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/davicalto a version that resolves this vulnerability.Fixed in 1.1.7-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
Who is at greatest risk from exploitation?
Any DAViCal user who can be induced to visit an attacker-supplied link is exposed. Administrative users are especially high risk because an attacker acting in their session can add a new administrator and gain full application access.
What does an attacker need to exploit this issue?
The attacker does not need prior privileges, but must convince a logged-in user to visit a crafted link. Exploitation relies on the application reflecting the action parameter without encoding.
What can an attacker do after successful exploitation?
The attacker can view all data available to the targeted user and perform actions as that user. Against an administrator, this can include creating a new admin account.