CVE-2019-18347
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize...
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
CVE-2019-18347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
CVE-2019-18347- Updated
- 2026-11-02
EUVDEUVD-2019-8135 No score
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
EUVD-2019-8135- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92gq-cfj6-292h No score
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize...
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
GHSA-92gq-cfj6-292h- Updated
- 2026-11-02
OSV
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
CVE-2019-18347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-18347
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
DEBIAN-CVE-2019-18347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-18347
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
UBUNTU-CVE-2019-18347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
davicalDebian:12 |
before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:13 |
before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:14 |
before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:8 |
before 1.1.3.1-1+deb8u1, plus listed versions 1.1.3.1-1 |
1.1.3.1-1+deb8u1 |
davicalDebian:9 |
before 1.1.5-1+deb9u1, plus listed versions 1.1.5-1 |
1.1.5-1+deb9u1 |
davicalDebian:10 |
before 1.1.8-1+deb10u1, plus listed versions 1.1.8-11.1.8-1+deb10u1~bpo9+1 |
1.1.8-1+deb10u1 |
davicalUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.3.1-11.1.4-11.1.4-1ubuntu11.1.4-1ubuntu1.1 |
None known |
davicalUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.5-11.1.6-11.1.7-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-18347 is a medium vulnerability (CVSS 5.4) in Davical, published December 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in davical 1.1.9.2-1.
References
davical.org
gitlab.com/davical-project/davical/blob/master/ChangeLog
hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability
seclists.org/fulldisclosure/2019/Dec/17
Show 9 moreShow less
packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.html
lists.debian.org/debian-lts-announce/2019/12/msg00016.html
debian.org/security/2019/dsa-4582
nvd.nist.gov/vuln/detail/CVE-2019-18347
github.com/advisories/GHSA-92gq-cfj6-292h
security-tracker.debian.org/tracker/CVE-2019-18347
ubuntu.com/security/CVE-2019-18347
cve.org/CVERecord?id=CVE-2019-18347