Home / mailings

PDF

[USN-9050-1] DAViCal vulnerabilities

Posted on 12 November 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-9050-1
November 11, 2026

davical vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in DAViCal.

Software Description:
- davical: PHP CalDAV and CardDAV Server

Details:

It was discovered that DAViCal did not properly encode certain request
parameters, leading to a reflected cross-site scripting vulnerability. A
remote attacker could possibly use this issue to perform actions as another
user, including adding administrator accounts. (CVE-2019-18345)

It was discovered that DAViCal did not protect against cross-site request
forgery. A remote attacker could possibly use this issue to perform actions
as an authenticated user, including adding administrator accounts.
(CVE-2019-18346)

It was discovered that DAViCal did not properly sanitize certain user
account fields, leading to a stored cross-site scripting vulnerability. An
authenticated user could possibly use this issue to execute arbitrary
script in the browser of another user, including an administrator.
(CVE-2019-18347)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
davical 1.1.7-1ubuntu0.1~esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-9050-1
CVE-2019-18345, CVE-2019-18346, CVE-2019-18347

--===============0126137710433960227==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP