Summary

The background and text color fields are not properly escaped in the event modal, allowing XSS for any user with view rights on the page, just by creating or editing an event and giving a script.

Details

Any user allowed to view the calendar page may create an event and add in the background or text color fields a script like <script>alert(1)</script>. The created event will be displayed inside the calendar with the default calendar colors and when opening the event modal, the script gets executed. The same behavior happens when a script is injected in the calendar default colors and a created event does not have set a custom color. The script doesn't seem to get executed when viewing the event page.

PoC

1. Install and activate the Mocca Calendar (Pro) application
2. Create an event and insert <script>alert(1)</script> inside the background/text color field(any new user can do this)
3. Click on the newly created event to open the modal
4. The page will run the script before fully loading the modal

Workarounds

None

Impact

Everyone who has view rights on the calendar page is susceptible to the attack, running any possibly malicious javascript/html/css code.