CVE-2020-23264

HIGH

Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS0.6%
Percentile49th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-352: Cross-Site Request Forgery (CSRF)

Web application does not verify that a request was intentionally sent by the authenticated user.

Related Attack Patterns (CAPEC)
CAPEC-462 Cross-Domain Search Timing
via CWE-352
CAPEC-467 Cross Site Identification
via CWE-352
CAPEC-62 Cross Site Request Forgery
via CWE-352
CAPEC-111 JSON Hijacking (aka JavaScript Hijacking)
via CWE-352

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A Cross-site request forgery (CSRF) vulnerability in Fork-CMS before version 5.8.2 allows remote attackers to hijack the authentication of logged-in administrators, potentially leading to unauthorized actions being performed on the system.

BSID: BS-2021-GLOBAL-028697-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-23264?
A Cross-site request forgery (CSRF) vulnerability in Fork-CMS before version 5.8.2 allows remote attackers to hijack the authentication of logged-in administrators, potentially leading to unauthorized actions being performed on the system.
What is the CVSS score for CVE-2020-23264?
CVE-2020-23264 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 0.6%.
Is CVE-2020-23264 actively exploited?
No confirmed active exploitation of CVE-2020-23264 as of 2026-09-25.
How do I remediate CVE-2020-23264?
Priority: IMMEDIATE.
What systems are affected by CVE-2020-23264?
CVE-2020-23264 affects Fork-Cms Fork Cms.
Vulnerability Details
CVE IDCVE-2020-23264
BSIDBS-2021-GLOBAL-028697-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2021-05-06
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
Cross-Site Request Forgery (CSRF)
SourceNVD
Official Description

Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from the lack of proper CSRF tokens in certain administrative actions within Fork-CMS. An attacker can exploit this by tricking an authenticated administrator into visiting a malicious website or clicking on a specially crafted link, which would then send a request to the Fork-CMS server on behalf of the administrator.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Fork-Cms Fork Cms < 5.8.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1988 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashd830782dc9f247541454e423880717492963b25579eb31794af49c2cded18f614096a8da29dcda40598d2bcdd25a7a3ab72e9fb26ad020dd5d1755196a03a213
Related CVEs affecting Fork-Cms
CVE-2019-15521 9.8 Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other ... CVE-2020-24036 8.8 PHP object injection in the Ajax endpoint of the backend in ForkCMS below ver... CVE-2021-28931 8.8 Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to cre... CVE-2020-23960 8.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Conso... CVE-2022-1064 8.8 SQL injection through marking blog comments on bulk as spam in GitHub reposit...
View all Fork-Cms CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →