Cross-Site Request Forgery in ForkCMS
High severity
GitHub Reviewed
Published
May 6, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
Jan 11, 2021
Reviewed
Apr 6, 2021
Published to the GitHub Advisory Database
May 6, 2021
Last updated
Feb 1, 2023
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.
References