{"api_version":"1","generated_at":"2026-07-23T08:18:16+00:00","cve":"CVE-2019-18345","urls":{"html":"https://cve.report/CVE-2019-18345","api":"https://cve.report/api/cve/CVE-2019-18345.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-18345","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-18345"},"summary":{"title":"CVE-2019-18345","description":"A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-12-12 14:15:00","updated_at":"2023-02-01 19:51:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://seclists.org/bugtraq/2019/Dec/30","name":"20191216 [SECURITY] [DSA 4582-1] davical security update","refsource":"BUGTRAQ","tags":[],"title":"Bugtraq: [SECURITY] [DSA 4582-1] davical security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html","name":"[debian-lts-announce] 20191214 [SECURITY] [DLA 2034-1] davical security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2034-1] davical security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.davical.org/","name":"https://www.davical.org/","refsource":"MISC","tags":["Product","Vendor Advisory"],"title":"DAViCal - DAViCal Home","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://gitlab.com/davical-project/davical/blob/master/ChangeLog","name":"https://gitlab.com/davical-project/davical/blob/master/ChangeLog","refsource":"MISC","tags":["Release Notes","Third Party Advisory"],"title":"ChangeLog · master · DAViCal Project / DAViCal · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"502"},{"url":"http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.html","name":"http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"DAViCal CalDAV Server 1.1.8 Reflective Cross Site Scripting ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wiki.davical.org/index.php/Main_Page","name":"https://wiki.davical.org/index.php/Main_Page","refsource":"MISC","tags":["Product","Vendor Advisory"],"title":"Davical","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2019/dsa-4582","name":"DSA-4582","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-4582-1 davical","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/","name":"https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"CVE-2019-18345 Reflected Cross-Site Scripting (XSS) vulnerability in DAViCal CalDAV Server – HackDefense","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18345","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18345","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"18345","vulnerable":"1","versionEndIncluding":"1.1.8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"davical","cpe5":"davical","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"18345","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"18345","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"18345","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-18345","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://www.davical.org/","refsource":"MISC","name":"https://www.davical.org/"},{"url":"https://wiki.davical.org/index.php/Main_Page","refsource":"MISC","name":"https://wiki.davical.org/index.php/Main_Page"},{"url":"https://gitlab.com/davical-project/davical/blob/master/ChangeLog","refsource":"MISC","name":"https://gitlab.com/davical-project/davical/blob/master/ChangeLog"},{"refsource":"MISC","name":"https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/","url":"https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.html","url":"http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.html"},{"refsource":"MLIST","name":"[debian-lts-announce] 20191214 [SECURITY] [DLA 2034-1] davical security update","url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html"},{"refsource":"DEBIAN","name":"DSA-4582","url":"https://www.debian.org/security/2019/dsa-4582"},{"refsource":"BUGTRAQ","name":"20191216 [SECURITY] [DSA 4582-1] davical security update","url":"https://seclists.org/bugtraq/2019/Dec/30"}]}},"nvd":{"publishedDate":"2019-12-12 14:15:00","lastModifiedDate":"2023-02-01 19:51:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL"},"exploitabilityScore":2.8,"impactScore":5.8},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:davical:davical:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.8","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"18345","Ordinal":"158719","Title":"CVE-2019-18345","CVE":"CVE-2019-18345","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"18345","Ordinal":"1","NoteData":"A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"18345","Ordinal":"2","NoteData":"2019-12-12","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"18345","Ordinal":"3","NoteData":"2019-12-16","Type":"Other","Title":"Modified"}]}}}