UBUNTU-CVE-2019-18346: CSRF
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/davicalto a version that resolves this vulnerability.Fixed in 1.1.7-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
Who is exposed to this issue?
DAViCal users who are already authenticated are exposed if they visit an attacker-controlled webpage. Administrative users are at greater risk because requests sent in their session can be used to perform administrative actions, such as creating another administrator account.
What does an attacker need to exploit it?
The attacker does not need credentials, but must cause an authenticated DAViCal user to visit an attacker-controlled webpage. Exploitation requires user interaction in the form of visiting that page.
How can I tell whether a system may be affected?
The issue affects DAViCal through version 1.1.8. Systems running DAViCal in that version range should be treated as potentially affected, particularly where administrator accounts use the application in a browser.