PT-2021-10872 · Fork Cms · Fork Cms

Carakas · Published 2021-05-06 · Updated 2022-02-10 · CVE-2020-23263

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fork CMS version 5.8.2

Description The issue allows remote attackers to inject arbitrary Javascript code via the navigation title parameter and the title parameter in the "/private/en/pages/add" endpoint. This enables attackers to execute malicious scripts on the client-side.

Recommendations For Fork CMS version 5.8.2, consider disabling the navigation title and title parameters in the "/private/en/pages/add" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the navigation title and title parameters in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-23263

GHSA-VP4X-94FF-2CMV

Affected Products

Fork Cms

References · 5

• https://github.com/forkcms/forkcms/pull/3093 · Patch
• https://osv.dev/vulnerability/CVE-2020-23263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23263 · Security Note
• https://osv.dev/vulnerability/GHSA-vp4x-94ff-2cmv · Vendor Advisory
• https://t.me/cvenotify/14325 · Telegram Post