USN-9050-1: davical vulnerabilities
It was discovered that DAViCal did not properly encode certain request parameters, leading to a reflected cross-site scripting vulnerability. A remote attacker could possibly use this issue to perform actions as another user, including adding administrator accounts. (CVE-2019-18345)
It was discovered that DAViCal did not protect against cross-site request forgery. A remote attacker could possibly use this issue to perform actions as an authenticated user, including adding administrator accounts. (CVE-2019-18346)
It was discovered that DAViCal did not properly sanitize certain user account fields, leading to a stored cross-site scripting vulnerability. An authenticated user could possibly use this issue to execute arbitrary script in the browser of another user, including an administrator. (CVE-2019-18347)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/davicalto a version that resolves this vulnerability.Fixed in 1.1.7-1ubuntu0.1~esm1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Who is exposed to these issues?
DAViCal users can be exposed to the reflected XSS and CSRF issues if they can be induced to interact with an attacker-controlled request. The stored XSS issue can affect other users, including administrators, when they view malicious content created by an authenticated user.
What level of access does an attacker need?
The reflected XSS and CSRF issues can be attempted remotely. Exploiting the stored XSS issue requires an authenticated DAViCal user account.
What could an attacker do if exploitation succeeds?
An attacker may perform actions as another user. The notice specifically identifies adding administrator accounts as a possible result; stored XSS may execute arbitrary script in another user's browser, including an administrator's.