CVE-2019-18347
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize...
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
CVE-2019-18347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
CVE-2019-18347- Updated
- 2026-11-02
EUVDEUVD-2019-8135No score
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
EUVD-2019-8135- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92gq-cfj6-292hNo score
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize...
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
GHSA-92gq-cfj6-292h- Updated
- 2026-11-02
OSV
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
CVE-2019-18347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-18347
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
DEBIAN-CVE-2019-18347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-18347
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
- Record
UBUNTU-CVE-2019-18347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-12
OSVUSN-9050-1No score
davical vulnerabilities
It was discovered that DAViCal did not properly encode certain request parameters, leading to a reflected cross-site scripting vulnerability. A remote attacker could possibly use this issue to perform actions as another user, including adding administrator accounts. (CVE-2019-18345)
It was discovered that DAViCal did not protect against cross-site request forgery. A remote attacker could possibly use this issue to perform actions as an authenticated user, including adding administrator accounts. (CVE-2019-18346)
It was discovered that DAViCal did not properly sanitize certain user account fields, leading to a stored cross-site scripting vulnerability. An authenticated user could possibly use this issue to execute arbitrary script in the browser of another user, including an administrator. (CVE-2019-18347)
- Record
USN-9050-1- Updated
- 2026-11-12
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
davicalDebian:12 | before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:13 | before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:14 | before 1.1.9.2-1 | 1.1.9.2-1 |
davicalDebian:8 From an advisory covering 3 CVEs | before 1.1.3.1-1+deb8u1, plus listed versions 1.1.3.1-1 | 1.1.3.1-1+deb8u1 |
davicalDebian:9 From an advisory covering 3 CVEs | before 1.1.5-1+deb9u1, plus listed versions 1.1.5-1 | 1.1.5-1+deb9u1 |
davicalDebian:10 From an advisory covering 3 CVEs | before 1.1.8-1+deb10u1, plus listed versions 1.1.8-11.1.8-1+deb10u1~bpo9+1 | 1.1.8-1+deb10u1 |
davicalUbuntu:16.04:LTS | All versions, plus listed versions 1.1.3.1-11.1.4-11.1.4-1ubuntu11.1.4-1ubuntu1.1 | None known |
davicalUbuntu:Pro:18.04:LTS | before 1.1.7-1ubuntu0.1~esm1, plus listed versions 1.1.5-11.1.6-11.1.7-1 | 1.1.7-1ubuntu0.1~esm1 |
davicalUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs | before 1.1.7-1ubuntu0.1~esm1, plus listed versions 1.1.5-11.1.6-11.1.7-1 | 1.1.7-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-18347 is a medium vulnerability (CVSS 5.4) in Davical, published December 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in davical 1.1.9.2-1.
References
davical.org
gitlab.com/davical-project/davical/blob/master/ChangeLog
hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability
seclists.org/fulldisclosure/2019/Dec/17
Show 12 moreShow less
packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.html
lists.debian.org/debian-lts-announce/2019/12/msg00016.html
debian.org/security/2019/dsa-4582
nvd.nist.gov/vuln/detail/CVE-2019-18347
github.com/advisories/GHSA-92gq-cfj6-292h
security-tracker.debian.org/tracker/CVE-2019-18347
ubuntu.com/security/CVE-2019-18347
cve.org/CVERecord?id=CVE-2019-18347