High severity · published Dec 4, 2019
CVE-2019-18346
A CSRF issue was discovered in DAViCal through 1.1.8
8.8
CVSS
1%
EPSS
No
On KEV
Description
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Davical · Davical
through 1.1.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18346
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18346
Third Party Advisory
http://packetstormsecurity.com/files/155629/DAViCal-CalDAV-Server-1.1.8-Cross-Site-Request-Forgery.html
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/17
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/18
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/19
Release Notes
https://gitlab.com/davical-project/davical/blob/master/ChangeLog
Exploit
https://hackdefense.com/publications/cve-2019-18346-davical-caldav-server-vulnerability/
More from Davical
9.3
CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8
5.4
CVE-2019-18347
A stored XSS issue was discovered in DAViCal through 1.1.8