PT-2019-5237 · Davical · Davical
Rick Verdoes
·
Published
2019-12-04
·
Updated
2020-01-04
·
CVE-2019-18347
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
DAViCal versions through 1.1.8
Description
A stored XSS issue was discovered in DAViCal. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another user. Affected database fields include
Username, Display Name, and Email. The vulnerability is related to insufficient protection measures for web page structures, which can be exploited by a remote attacker to impact data integrity through a specially crafted HTML page.Recommendations
For versions through 1.1.8, update to a version that adequately sanitizes output of user-set fields to prevent stored XSS attacks. As a temporary workaround, consider restricting access to the
Username, Display Name, and Email fields to minimize the risk of exploitation. Avoid using these fields in a way that could allow JavaScript execution until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Davical