Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

id: CVE-2017-20194

info:
  name: Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
  author: DhiyaneshDK
  severity: medium
  description: |
    The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.
  impact: |
    Unauthenticated attackers can export all form entries, leading to potential data breaches and privacy violations.
  remediation: |
    Update to version 2.05.04 or later.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7600fe1-94e4-4e3e-a9a6-ff3589813715?source=cve
    - https://wordpress.org/plugins/formidable/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-20194
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2017-20194
    cwe-id: CWE-200
    epss-score: 0.01098
    epss-percentile: 0.61303
    cpe: cpe:2.3:a:strategy11:formidable_form_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: strategy11
    product: formidable_form_builder
    framework: wordpress
    public-query: "/wp-content/plugins/formidable/"
  tags: cve,cve2017,wpscan,wordpress,wp,wp-plugin,formidable,passive,vkev,vuln

http:
  - raw:
      - |
        GET /wp-content/plugins/formidable/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'compare_versions(version, "< 2.05.03")'
          - 'contains(body, "Formidable Forms")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - "(?mi)Stable tag: ([0-9.]+)"
# digest: 4b0a00483046022100ddff3b39071ba50372ee5d189511e191aaf07fbc13d099b52804e1c8d0cc53c1022100ae0b09d61ee64044004241ffe2f80e7c8bcbfcda81e3b28fda6e3212bbb7eb97:922c64590222798bb761d5b6d8e72950