CVE-2024-21727 - Vulnerability Details - OpenCVE

Description

XSS vulnerability in DP Calendar component for Joomla.

Published: 2024-02-15

Score: 6.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

digital-peak.com

DP Calendar for Joomla

unaffected

Version	Status	Constraints
`8.0.0-8.14.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:digital-peak:dpcalendar:*:*:*:*:-:joomla\!:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0009.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://extensions.joomla.org/extension/dpcalendar/

History

Thu, 05 Jun 2025 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Digital-peak dpcalendar
CPEs		cpe:2.3:a:digital-peak:dpcalendar:::::-:joomla\!::
Vendors & Products		Digital-peak dpcalendar

Tue, 29 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Digital-peak Digital-peak dp Calendar For Joomla
CPEs		cpe:2.3:a:digital-peak:dp_calendar_for_joomla::::::::
Vendors & Products		Digital-peak Digital-peak dp Calendar For Joomla
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Subscriptions

Digital-peak Dp Calendar For Joomla Dpcalendar

MITRE

Status: PUBLISHED

Assigner: Joomla

Published: 2024-02-15T06:54:28.972Z

Updated: 2024-11-03T04:33:10.046Z

Reserved: 2024-01-01T04:30:58.881Z

Link: CVE-2024-21727

Vulnrichment

Updated: 2024-08-01T22:27:36.114Z

NVD

Status : Analyzed

Published: 2024-02-15T07:15:11.167

Modified: 2025-06-05T20:12:55.387

Link: CVE-2024-21727

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21727", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "state": "PUBLISHED", "assignerShortName": "Joomla", "dateReserved": "2024-01-01T04:30:58.881Z", "datePublished": "2024-02-15T06:54:28.972Z", "dateUpdated": "2024-11-03T04:33:10.046Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://extensions.joomla.org/extension/dpcalendar/", "defaultStatus": "unaffected", "packageName": "com_dpcalendar", "product": "DP Calendar for Joomla", "vendor": "digital-peak.com", "versions": [{"status": "affected", "version": "8.0.0-8.14.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Sai Krishna P and Siva Pothuluru S"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "XSS vulnerability in DP Calendar component for Joomla."}], "value": "XSS vulnerability in DP Calendar component for Joomla."}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2024-11-03T04:33:10.046Z"}, "references": [{"tags": ["product"], "url": "https://extensions.joomla.org/extension/dpcalendar/"}], "source": {"discovery": "UNKNOWN"}, "title": "Extension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "digital-peak", "product": "dp_calendar_for_joomla", "cpes": ["cpe:2.3:a:digital-peak:dp_calendar_for_joomla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "8.0.0", "status": "affected", "lessThanOrEqual": "8.14.0", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-13T19:56:06.442428Z", "id": "CVE-2024-21727", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T18:58:13.302Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.114Z"}, "title": "CVE Program Container", "references": [{"tags": ["product", "x_transferred"], "url": "https://extensions.joomla.org/extension/dpcalendar/"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://extensions.joomla.org/extension/dpcalendar/", "tags": ["product", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.114Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-21727", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-13T19:56:06.442428Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:digital-peak:dp_calendar_for_joomla:*:*:*:*:*:*:*:*"], "vendor": "digital-peak", "product": "dp_calendar_for_joomla", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "custom", "lessThanOrEqual": "8.14.0"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:10.631Z"}}], "cna": {"title": "Extension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Sai Krishna P and Siva Pothuluru S"}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}], "affected": [{"vendor": "digital-peak.com", "product": "DP Calendar for Joomla", "versions": [{"status": "affected", "version": "8.0.0-8.14.0"}], "packageName": "com_dpcalendar", "collectionURL": "https://extensions.joomla.org/extension/dpcalendar/", "defaultStatus": "unaffected"}], "references": [{"url": "https://extensions.joomla.org/extension/dpcalendar/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "XSS vulnerability in DP Calendar component for Joomla.", "supportingMedia": [{"type": "text/html", "value": "XSS vulnerability in DP Calendar component for Joomla.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2024-11-02T04:34:34.376Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21727", "state": "PUBLISHED", "dateUpdated": "2024-11-02T04:34:34.376Z", "dateReserved": "2024-01-01T04:30:58.881Z", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "datePublished": "2024-02-15T06:54:28.972Z", "assignerShortName": "Joomla"}, "dataVersion": "5.1"}