CVE-2020-23960

HIGH

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass...

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS0.7%
Percentile52th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-352: Cross-Site Request Forgery (CSRF)

Web application does not verify that a request was intentionally sent by the authenticated user.

Related Attack Patterns (CAPEC)
CAPEC-462 Cross-Domain Search Timing
via CWE-352
CAPEC-467 Cross Site Identification
via CWE-352
CAPEC-62 Cross Site Request Forgery
via CWE-352
CAPEC-111 JSON Hijacking (aka JavaScript Hijacking)
via CWE-352

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Multiple CSRF vulnerabilities in Fork CMS Admin Console before version 5.8.3 allow remote attackers to perform unauthorized actions with administrative privileges.

BSID: BS-2021-GLOBAL-173524-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-23960?
Multiple CSRF vulnerabilities in Fork CMS Admin Console before version 5.8.3 allow remote attackers to perform unauthorized actions with administrative privileges.
What is the CVSS score for CVE-2020-23960?
CVE-2020-23960 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 0.7%.
Is CVE-2020-23960 actively exploited?
No confirmed active exploitation of CVE-2020-23960 as of 2026-09-25.
How do I remediate CVE-2020-23960?
Priority: IMMEDIATE. Advisory: https://www.fork-cms.com/blog/detail/fork-5.8.3-released
What systems are affected by CVE-2020-23960?
CVE-2020-23960 affects Fork-Cms Fork Cms.
Vulnerability Details
CVE IDCVE-2020-23960
BSIDBS-2021-GLOBAL-173524-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2021-01-11
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
Cross-Site Request Forgery (CSRF)
SourceNVD
Official Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerabilities are due to improper handling of CSRF tokens in the Admin Console, enabling attackers to trick authenticated administrators into executing arbitrary actions without their knowledge or consent.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Fork-Cms Fork Cms < 5.8.3
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2103 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash7ee959d5d3b2d1e6104e1be55f06d9ff580fbb4de0922351c990de0639f7e68513823bd20779426856fc42c8e4107e9b44814581550abc9b90c2a00e113e4faf
Related CVEs affecting Fork-Cms
CVE-2019-15521 9.8 Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other ... CVE-2020-23264 8.8 Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attac... CVE-2021-28931 8.8 Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to cre... CVE-2020-24036 8.8 PHP object injection in the Ajax endpoint of the backend in ForkCMS below ver... CVE-2022-1064 8.8 SQL injection through marking blog comments on bulk as spam in GitHub reposit...
View all Fork-Cms CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →