CVE-2019-18345 Cross-site scripting in n/a
Reflected XSS in DAViCal allows attackers to view user data and perform actions, potentially gaining admin access via crafted links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-18345?
CVE-2019-18345 is a critical cross-site scripting vulnerability in Debian Debian Linux, published on 12 Dec 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
Weakness: CWE-79
Which versions are affected by CVE-2019-18345?
It affects 2 products.
Products include Davical Davical, Debian Debian Linux.
How do I fix CVE-2019-18345?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-18345 being exploited?
There is no known exploitation of CVE-2019-18345 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-18345, GHSA-27vg-v28w-gqgh, UBUNTU-CVE-2019-18345.