CVE-2019-18346

A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.

• CWE-352

• http://packetstormsecurity.com/files/155629/DAViCal-CalDAV-Server-1.1.8-Cross-Site-Request-Forgery.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/17Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/18Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/19Third Party Advisory
• https://gitlab.com/davical-project/davical/blob/master/ChangeLogRelease Notes, Third Party Advisory
• https://hackdefense.com/publications/cve-2019-18346-davical-caldav-server-vulnerability/Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html
• https://seclists.org/bugtraq/2019/Dec/30
• https://www.davical.org/Product
• https://www.debian.org/security/2019/dsa-4582
• http://packetstormsecurity.com/files/155629/DAViCal-CalDAV-Server-1.1.8-Cross-Site-Request-Forgery.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/17Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/18Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/19Third Party Advisory
• https://gitlab.com/davical-project/davical/blob/master/ChangeLogRelease Notes, Third Party Advisory
• https://hackdefense.com/publications/cve-2019-18346-davical-caldav-server-vulnerability/Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html
• https://seclists.org/bugtraq/2019/Dec/30
• https://www.davical.org/Product
• https://www.debian.org/security/2019/dsa-4582

Published

Dec 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1834A vulnerability in the internal packet processing of Cisco A…7.4
• CVE-2019-18340A vulnerability has been identified in Control Center Server…5.5
• CVE-2019-18341A vulnerability has been identified in Control Center Server…5.3
• CVE-2019-18342A vulnerability has been identified in Control Center Server…9.9
• CVE-2019-18344Sourcecodester Online Grading System 1.0 is vulnerable to un…9.8
• CVE-2019-18345A reflected XSS issue was discovered in DAViCal through 1.1.…9.3
• CVE-2019-18347A stored XSS issue was discovered in DAViCal through 1.1.8. …5.4
• CVE-2019-18348An issue was discovered in urllib2 in Python 2.x through 2.7…6.1
• CVE-2019-18349HotkeyP through 4.9 r96 allows privilege escalation in the p…9.8
• CVE-2019-1835A vulnerability in the CLI of Cisco Aironet Access Points (A…4.4
• CVE-2019-18350In Ant Design Pro 4.0.0, reflected XSS in the user/login red…6.1
• CVE-2019-18351Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…