Description
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | davical | 1.1.9.2-1 | — |
| Debian 13 | davical | 1.1.9.2-1 | — |
| Debian 12 | davical | 1.1.9.2-1 | — |
| Debian 10 | davical | 1.1.8-1+deb10u1 | DSA-4582-1 |
| Debian 9 | davical | 1.1.5-1+deb9u1 | DSA-4582-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | davical | 1.1.3.1-1+deb8u1 | DLA-2034-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | davical | No fix yet | — |
| Ubuntu 16.04 LTS | davical | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | davical | 1.1.7-1ubuntu0.1~esm1 | USN-9050-1 |
Advisories 3
- USN-9050-1 davical vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- DSA-4582-1 davical - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2034-1 davical - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://www.davical.org/
- https://gitlab.com/davical-project/davical/blob/master/ChangeLog
- https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/
- 20191210 CVE-2019-18347 Persistent Cross-Site Scripting (XSS) vulnerability in DAViCal CalDAV Server mailing-list
- 20191210 CVE-2019-18345 Reflected Cross-Site Scripting (XSS) vulnerability in DAViCal CalDAV Server mailing-list
- 20191210 CVE-2019-18346 Cross-Site Request Forgery (CSRF) vulnerability in DAViCal CalDAV Server mailing-list
- http://packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.html
- [debian-lts-announce] 20191214 [SECURITY] [DLA 2034-1] davical security update mailing-list
- DSA-4582 vendor-advisory
- 20191216 [SECURITY] [DSA 4582-1] davical security update mailing-list