CVE-2019-18346
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker...
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
- Record
CVE-2019-18346- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
- Record
CVE-2019-18346- Updated
- 2026-11-02
EUVDEUVD-2019-8134 No score
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
- Record
EUVD-2019-8134- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-27m2-q889-735v No score
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker...
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
- Record
GHSA-27m2-q889-735v- Updated
- 2026-11-02
OSV
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
- Record
CVE-2019-18346- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-18346
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
- Record
DEBIAN-CVE-2019-18346- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-18346
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
- Record
UBUNTU-CVE-2019-18346- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
davicalDebian:12 |
before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:13 |
before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:14 |
before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:8 |
before 1.1.3.1-1+deb8u1, plus listed versions 1.1.3.1-1 |
1.1.3.1-1+deb8u1 |
davicalDebian:9 |
before 1.1.5-1+deb9u1, plus listed versions 1.1.5-1 |
1.1.5-1+deb9u1 |
davicalDebian:10 |
before 1.1.8-1+deb10u1, plus listed versions 1.1.8-11.1.8-1+deb10u1~bpo9+1 |
1.1.8-1+deb10u1 |
davicalUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.3.1-11.1.4-11.1.4-1ubuntu11.1.4-1ubuntu1.1 |
None known |
davicalUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.5-11.1.6-11.1.7-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-18346 is a high vulnerability (CVSS 8.8) in Davical, published December 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in davical 1.1.9.2-1.
References
davical.org
gitlab.com/davical-project/davical/blob/master/ChangeLog
hackdefense.com/publications/cve-2019-18346-davical-caldav-server-vulnerability
seclists.org/fulldisclosure/2019/Dec/17
Show 9 moreShow less
packetstormsecurity.com/files/155629/DAViCal-CalDAV-Server-1.1.8-Cross-Site-Request-Forgery.html
lists.debian.org/debian-lts-announce/2019/12/msg00016.html
debian.org/security/2019/dsa-4582
nvd.nist.gov/vuln/detail/CVE-2019-18346
github.com/advisories/GHSA-27m2-q889-735v
security-tracker.debian.org/tracker/CVE-2019-18346
ubuntu.com/security/CVE-2019-18346
cve.org/CVERecord?id=CVE-2019-18346