UBUNTU-CVE-2019-18347: XSS
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/davicalto a version that resolves this vulnerability.Fixed in 1.1.7-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
Who can exploit this issue?
An unprivileged DAViCal user who can set values in the Username, Display Name, or Email fields can store JavaScript in those fields.
What must happen for the stored script to execute?
Another user must view output containing the malicious stored field. That viewer may be a privileged user, so exploitation can affect users with greater access than the attacker.
Are default installations affected?
The provided information does not state whether the affected fields are exposed or editable in DAViCal's default configuration.