VULNERABILITY INTELLIGENCE

CVE-2020-23960

CVSS score8.8 HIGH

EPSS probability0.68%

CISA KEVNot currently listed

Published2021-01-11

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.

Weakness classification

CWE-352: Cross-Site Request Forgery (CSRF)

Primary references

cve@mitre.org — Patch, Third Party Advisory
cve@mitre.org — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory