CVE-2020-13868

Comments plugin Cross-Site Request Forgery (CSRF)

6.5 MediumFix available

CVE-2020-13868 is a medium vulnerability (CVSS 6.5) in Verbb Comments, published June 5, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in verbb/comments 1.5.5.

What does this mean?

Severity: 6.5 MediumCVSS 3.1, NVD
Exploit chance: 0.43%EPSS, 37th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.5.5verbb/comments +1 more

Description

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.43%Unchanged since Apr 14, 2021

Affected products

verbb comments

Affected packages

Affected packages
Package	Affected	Fixed
`verbb/comments` Packagist	before 1.5.5	1.5.5
`verbb/comments` Packagist	before 1.5.5, plus listed versions 0.3.60.3.81.0.01.0.11.0.2 Show 45 moreShow less 1.0.31.0.41.0.51.0.61.0.6.11.0.6.21.0.6.31.0.71.0.7.11.1.01.1.11.1.101.1.21.1.31.1.41.1.51.1.61.1.71.1.7.11.1.81.1.91.2.01.2.11.2.21.2.31.2.41.3.01.3.11.3.101.3.111.3.121.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.1.11.5.01.5.11.5.2	1.5.5

What each source reports

NVD Score used6.5

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

Record: CVE-2020-13868
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-352
Updated: 2026-11-02

CVE ListNo score

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

Record: CVE-2020-13868
Updated: 2026-11-02

EUVDEUVD-2022-2439No score

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

Record: EUVD-2022-2439
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4r8c-pj7x-m5jx6.5

Comments plugin Cross-Site Request Forgery (CSRF)

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

Record: GHSA-4r8c-pj7x-m5jx
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSV6.5

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

Record: CVE-2020-13868
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-4r8c-pj7x-m5jx6.5

Comments plugin Cross-Site Request Forgery (CSRF)

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

Record: GHSA-4r8c-pj7x-m5jx
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-352
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

This page doesn't list everything

Left out here: 2 versions. The JSON record has them.