Medium severity · published Dec 4, 2019
CVE-2019-18347
A stored XSS issue was discovered in DAViCal through 1.1.8
5.4
CVSS
1.1%
EPSS
No
On KEV
Description
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Davical · Davical
through 1.1.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18347
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18347
Third Party Advisory
http://packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.html
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/17
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/18
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/19
Release Notes
https://gitlab.com/davical-project/davical/blob/master/ChangeLog
Exploit
https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/
More from Davical
9.3
CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8
8.8
CVE-2019-18346
A CSRF issue was discovered in DAViCal through 1.1.8