CVE-2024-21727 - OpenCVE

XSS vulnerability in DP Calendar component for Joomla.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Digital-peak	Dp Calendar For Joomla

No data.

No data.

References

Link	Providers
https://extensions.joomla.org/extension/dpcalendar/

History

Tue, 29 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Digital-peak Digital-peak dp Calendar For Joomla
CPEs		cpe:2.3:a:digital-peak:dp_calendar_for_joomla::::::::
Vendors & Products		Digital-peak Digital-peak dp Calendar For Joomla
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Joomla

Published: 2024-02-15T06:54:28.972Z

Updated: 2024-11-03T04:33:10.046Z

Reserved: 2024-01-01T04:30:58.881Z

Link: CVE-2024-21727

Vulnrichment

Updated: 2024-08-01T22:27:36.114Z

NVD

Status : Awaiting Analysis

Published: 2024-02-15T07:15:11.167

Modified: 2024-10-29T19:35:15.020

Link: CVE-2024-21727

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21727", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "state": "PUBLISHED", "assignerShortName": "Joomla", "dateReserved": "2024-01-01T04:30:58.881Z", "datePublished": "2024-02-15T06:54:28.972Z", "dateUpdated": "2024-11-03T04:33:10.046Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://extensions.joomla.org/extension/dpcalendar/", "defaultStatus": "unaffected", "packageName": "com_dpcalendar", "product": "DP Calendar for Joomla", "vendor": "digital-peak.com", "versions": [{"status": "affected", "version": "8.0.0-8.14.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Sai Krishna P and Siva Pothuluru S"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "XSS vulnerability in DP Calendar component for Joomla."}], "value": "XSS vulnerability in DP Calendar component for Joomla."}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2024-11-03T04:33:10.046Z"}, "references": [{"tags": ["product"], "url": "https://extensions.joomla.org/extension/dpcalendar/"}], "source": {"discovery": "UNKNOWN"}, "title": "Extension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "digital-peak", "product": "dp_calendar_for_joomla", "cpes": ["cpe:2.3:a:digital-peak:dp_calendar_for_joomla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "8.0.0", "status": "affected", "lessThanOrEqual": "8.14.0", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-13T19:56:06.442428Z", "id": "CVE-2024-21727", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T18:58:13.302Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.114Z"}, "title": "CVE Program Container", "references": [{"tags": ["product", "x_transferred"], "url": "https://extensions.joomla.org/extension/dpcalendar/"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://extensions.joomla.org/extension/dpcalendar/", "tags": ["product", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.114Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-21727", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-13T19:56:06.442428Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:digital-peak:dp_calendar_for_joomla:*:*:*:*:*:*:*:*"], "vendor": "digital-peak", "product": "dp_calendar_for_joomla", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "custom", "lessThanOrEqual": "8.14.0"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:10.631Z"}}], "cna": {"title": "Extension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Sai Krishna P and Siva Pothuluru S"}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}], "affected": [{"vendor": "digital-peak.com", "product": "DP Calendar for Joomla", "versions": [{"status": "affected", "version": "8.0.0-8.14.0"}], "packageName": "com_dpcalendar", "collectionURL": "https://extensions.joomla.org/extension/dpcalendar/", "defaultStatus": "unaffected"}], "references": [{"url": "https://extensions.joomla.org/extension/dpcalendar/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "XSS vulnerability in DP Calendar component for Joomla.", "supportingMedia": [{"type": "text/html", "value": "XSS vulnerability in DP Calendar component for Joomla.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2024-11-02T04:34:34.376Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21727", "state": "PUBLISHED", "dateUpdated": "2024-11-02T04:34:34.376Z", "dateReserved": "2024-01-01T04:30:58.881Z", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "datePublished": "2024-02-15T06:54:28.972Z", "assignerShortName": "Joomla"}, "dataVersion": "5.1"}