Vulnerability Details : CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2019-18345
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:davical:davical:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-18345
0.54%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 77 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-18345
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
9.3
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
2.8
|
5.8
|
NIST |
CWE ids for CVE-2019-18345
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-18345
-
https://gitlab.com/davical-project/davical/blob/master/ChangeLog
ChangeLog · master · DAViCal Project / DAViCal · GitLabRelease Notes;Third Party Advisory
-
https://seclists.org/bugtraq/2019/Dec/30
Bugtraq: [SECURITY] [DSA 4582-1] davical security updateMailing List;Third Party Advisory
-
https://www.debian.org/security/2019/dsa-4582
Debian -- Security Information -- DSA-4582-1 davicalThird Party Advisory
-
https://www.davical.org/
DAViCal - DAViCal HomeProduct;Vendor Advisory
-
http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.html
DAViCal CalDAV Server 1.1.8 Reflective Cross Site Scripting ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://wiki.davical.org/index.php/Main_Page
DavicalProduct;Vendor Advisory
-
https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html
[SECURITY] [DLA 2034-1] davical security updateMailing List;Third Party Advisory
-
https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/
CVE-2019-18345 Reflected Cross-Site Scripting (XSS) vulnerability in DAViCal CalDAV Server – HackDefenseExploit;Third Party Advisory
Jump to