A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://www.davical.org/ | x_refsource_MISC |
| https://gitlab.com/davical-project/davical/blob/master/ChangeLog | x_refsource_MISC |
| https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/ | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/Dec/17 | mailing-list x_refsource_FULLDISC |
| http://seclists.org/fulldisclosure/2019/Dec/19 | mailing-list x_refsource_FULLDISC |
| http://seclists.org/fulldisclosure/2019/Dec/18 | mailing-list x_refsource_FULLDISC |
| http://packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.html | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html | mailing-list x_refsource_MLIST |
| https://www.debian.org/security/2019/dsa-4582 | vendor-advisory x_refsource_DEBIAN |
| https://seclists.org/bugtraq/2019/Dec/30 | mailing-list x_refsource_BUGTRAQ |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://www.davical.org/ | x_refsource_MISC x_transferred |
| https://gitlab.com/davical-project/davical/blob/master/ChangeLog | x_refsource_MISC x_transferred |
| https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/ | x_refsource_MISC x_transferred |
| http://seclists.org/fulldisclosure/2019/Dec/17 | mailing-list x_refsource_FULLDISC x_transferred |
| http://seclists.org/fulldisclosure/2019/Dec/19 | mailing-list x_refsource_FULLDISC x_transferred |
| http://seclists.org/fulldisclosure/2019/Dec/18 | mailing-list x_refsource_FULLDISC x_transferred |
| http://packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.html | x_refsource_MISC x_transferred |
| https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html | mailing-list x_refsource_MLIST x_transferred |
| https://www.debian.org/security/2019/dsa-4582 | vendor-advisory x_refsource_DEBIAN x_transferred |
| https://seclists.org/bugtraq/2019/Dec/30 | mailing-list x_refsource_BUGTRAQ x_transferred |