Vulnerability · Published Jan 11, 2021 · Assigned by mitre
CVE-2020-23960
High 8.8
In plain English
A high-severity security flaw in the forkcms/forkcms package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | forkcms/forkcms | 5.8.3 | GHSA-pvgf-mrr4-cw7r |
Affected products (as reported)
References
- https://github.com/forkcms/forkcms/pull/3123 x_refsource_MISC
- https://www.fork-cms.com/blog/detail/fork-5.8.3-released x_refsource_MISC