CVE catalog

CVE-2019-18347

davical: CVE-2019-18347

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.13% · Oct 25, 2026

A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandavicalsid1.1.13-2fixed
Debiandavicalforky1.1.13-2fixed
Debiandavicaltrixie1.1.12-2.1fixed
Debiandavicalbookworm1.1.12-2fixed
Ubuntudavical16.041.1.3.1-1vulnerable
Ubuntudavical16.041.1.4-1vulnerable
Ubuntudavical16.041.1.4-1ubuntu1vulnerable
Ubuntudavical16.041.1.4-1ubuntu1.1vulnerable
Ubuntudavical18.041.1.5-1vulnerable
Ubuntudavical18.041.1.6-1vulnerable
Ubuntudavical18.041.1.7-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandavicalsourcesid1.1.9.2-1not yet assignedNot reported[946343]
Debiandavicalsourceforky1.1.9.2-1not yet assignedNot reported[946343]
Debiandavicalsourcetrixie1.1.9.2-1not yet assignedNot reported[946343]
Debiandavicalsourcebookworm1.1.9.2-1not yet assignedNot reported[946343]

[Debian bug #946343]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [davical]Fixed
    Details (2)

    • 1.1.12-2 · all · bookworm

      Fixed · Fixed: 1.1.9.2-1

      dsa · davical · debian · bookworm; dsa · davical · debian · 12

    • 1.1.12-2 · all · bookworm

      Fixed · Fixed: 1.1.9.2-1

      dsa · davical · debian · bookworm; dsa · davical · debian · 12

  • [davical-doc]Fixed

    Source package: [davical]

    Details (2)

    • 1.1.12-2 · all · bookworm

      Fixed · Fixed: 1.1.9.2-1

      dsa · davical · debian · bookworm; dsa · davical · debian · 12

    • 1.1.12-2 · all · bookworm

      Fixed · Fixed: 1.1.9.2-1

      dsa · davical · debian · bookworm; dsa · davical · debian · 12

[Debian 13 (Trixie)]

  • [davical]Fixed
    Details (2)

    • 1.1.12-2.1 · all · trixie

      Fixed · Fixed: 1.1.9.2-1

      dsa · davical · debian · 13

    • 1.1.12-2.1 · all · trixie

      Fixed · Fixed: 1.1.9.2-1

      dsa · davical · debian · 13

  • [davical-doc]Fixed

    Source package: [davical]

    Details (2)

    • 1.1.12-2.1 · all · trixie

      Fixed · Fixed: 1.1.9.2-1

      dsa · davical · debian · 13

    • 1.1.12-2.1 · all · trixie

      Fixed · Fixed: 1.1.9.2-1

      dsa · davical · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]