FKIE_CVE-2017-17780

Vulnerability from fkie_nvd - Published: 2017-12-20 03:29 - Updated: 2026-06-17 01:11
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
References
cve@mitre.orghttps://packetstormsecurity.com/files/145469/Clockwork-SMS-Cross-Site-Scripting.htmlExploit, Issue Tracking, Third Party Advisory, VDB Entry
cve@mitre.orghttps://plugins.trac.wordpress.org/changeset/1781424/clockwork-two-factor-authentication/trunk/templates/clockwork-test-message.php?old=706348&old_path=clockwork-two-factor-authentication%2Ftrunk%2Ftemplates%2Fclockwork-test-message.phpIssue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://packetstormsecurity.com/files/145469/Clockwork-SMS-Cross-Site-Scripting.htmlExploit, Issue Tracking, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/changeset/1781424/clockwork-two-factor-authentication/trunk/templates/clockwork-test-message.php?old=706348&old_path=clockwork-two-factor-authentication%2Ftrunk%2Ftemplates%2Fclockwork-test-message.phpIssue Tracking, Patch, Third Party Advisory
Impacted products
Vendor Product Version
mediaburst booking_calendar_sms 1.0.5
mediaburst clockwork_sms_notfications 2.0.3
mediaburst contact_form_7_sms 2.3.0
mediaburst fast_secure_contact_form_sms 2.1.2
mediaburst formidable 1.0.2
mediaburst gravity_forms 2.2
mediaburst two-factor_authentication 1.0.2
mediaburst wp_e-commerce 2.0.5
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mediaburst:booking_calendar_sms:1.0.5:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "4C9BC167-7819-44BD-930D-C74F1994E485",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mediaburst:clockwork_sms_notfications:2.0.3:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "2F02FBF0-D546-4E09-AC4F-FF1024954089",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mediaburst:contact_form_7_sms:2.3.0:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "ACA06C65-8A76-4333-9CAC-01B33E247FFE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mediaburst:fast_secure_contact_form_sms:2.1.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "BCC91481-9ABD-4119-9BA4-6F4FE9F72B85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mediaburst:formidable:1.0.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "70394F55-7CD7-4FDE-AB27-620CDC2AAD4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mediaburst:gravity_forms:2.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "0FE1E86E-8BBD-4690-959D-603AD8D9A920",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mediaburst:two-factor_authentication:1.0.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "4643968B-EA48-49B8-AACC-EEBA690A3E19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mediaburst:wp_e-commerce:2.0.5:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "B8B63822-6EFA-4FB1-BF3A-05ED2B9FB333",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Clockwork SMS clockwork-test-message.php component has XSS via a crafted \"to\" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5."
    },
    {
      "lang": "es",
      "value": "El componente clockwork-test-message.php en Clockwork SMS tiene una vulnerabilidad Cross-Site Scripting (XSS) a trav\u00e9s de un par\u00e1metro \"to\" manipulado en una petici\u00f3n clockwork-test-message en wp-admin/admin.php. Este c\u00f3digo de componente se encuentra en los siguientes plugins de WordPress: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2 y WP e-Commerce - Clockwork SMS 2.0.5."
    }
  ],
  "id": "CVE-2017-17780",
  "lastModified": "2026-06-17T01:11:38.130",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-12-20T03:29:00.427",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://packetstormsecurity.com/files/145469/Clockwork-SMS-Cross-Site-Scripting.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://plugins.trac.wordpress.org/changeset/1781424/clockwork-two-factor-authentication/trunk/templates/clockwork-test-message.php?old=706348\u0026old_path=clockwork-two-factor-authentication%2Ftrunk%2Ftemplates%2Fclockwork-test-message.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://packetstormsecurity.com/files/145469/Clockwork-SMS-Cross-Site-Scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://plugins.trac.wordpress.org/changeset/1781424/clockwork-two-factor-authentication/trunk/templates/clockwork-test-message.php?old=706348\u0026old_path=clockwork-two-factor-authentication%2Ftrunk%2Ftemplates%2Fclockwork-test-message.php"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.