In short
- CVE-2020-23960 is a HIGH (CVSS 8.8) vulnerability affecting forkcms/forkcms, fork cms (fork-cms).
- Chance of exploitation in the next 30 days (EPSS): 0.68%, higher than 52.6% of all vulnerabilities.
- Fix: update to 5.8.3 or later.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.
NVD description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.
More vulnerabilities in forkcms/forkcms
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free