GitHub Advisoryadvisory · Packagist

GHSA-pvgf-mrr4-cw7r Cross-Site Request Forgery in ForkCMS

HIGH Published 2021-05-06 Modified 2021-04-06 Official page ↗
Aliases
CVE-2020-23960
Ecosystem
Packagist
Packages
forkcms/forkcms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2021-04-06

Affected packages

• Packagist forkcms/forkcms: < 5.8.3 → fixed in 5.8.3

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.

Related

Alias · CVE (1)

  • CVE-2020-23960 Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References