XSS in Mediaburst Booking Calendar Sms
CVE-2017-17780
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.010 (57.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Mediaburst Booking_calendar_sms — versions 1.0.5
- Mediaburst Clockwork_sms_notfications — versions 2.0.3
- Mediaburst Contact_form_7_sms — versions 2.3.0
- Mediaburst Fast_secure_contact_form_sms — versions 2.1.2
- Mediaburst Formidable — versions 1.0.2
- Mediaburst Gravity_forms — versions 2.2
- Mediaburst Two-factor_authentication — versions 1.0.2
- Mediaburst Wp_e-commerce — versions 2.0.5
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC, Issue Tracking)
Frequently asked questions
- What is CVE-2017-17780?
- CVE-2017-17780 is a medium-severity vulnerability in Mediaburst Booking Calendar Sms, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-12-20.
- How severe is CVE-2017-17780?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2017-17780 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.