cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 115

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2023-20011EPSS 0.4%

    A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a …

  2. 8.8CVE-2023-24415EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions.

  3. 8.8CVE-2023-0988EPSS 0.5%

    A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown processing of the file admin/ajax.php?action=save_user. The manipulation leads to cros…

  4. 8.8CVE-2023-24384EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4 versions.

  5. 8.8CVE-2023-23659EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions.

  6. 4.3CVE-2022-4386EPSS 0.3%

    The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack

  7. 4.3CVE-2022-48320EPSS 0.2%

    Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages.

  8. 8.8CVE-2015-10081EPSS 0.4%

    A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be i…

  9. 5.7CVE-2023-25569EPSS 0.4%

    Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that …

  10. 5.4CVE-2023-24388EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).

  11. 4.3CVE-2023-23899EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Extensions For CF7 plugin <= 2.0.8 versions leads to arbitrary plugin activation.

  12. 6.5CVE-2021-33396EPSS 0.3%

    Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php.

  13. 3.5CVE-2023-23847EPSS 0.4%

    A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another meth…

  14. 8.8CVE-2023-23465EPSS 0.3%

    Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.

  15. 8.8CVE-2023-25767EPSS 0.5%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.

  16. 6.1CVE-2022-47373EPSS 0.3%

    Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/san…

  17. 5.4CVE-2022-47372EPSS 0.2%

    Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a vict…

  18. 8.8CVE-2022-29557EPSS 0.3%

    LexisNexis Firco Compliance Link 3.7 allows CSRF.

  19. 4.3CVE-2023-22942EPSS 0.2%

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTT…

  20. 8.8CVE-2023-25065EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.

  21. 8.8CVE-2023-24382EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.

  22. 8.8CVE-2023-24377EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.

  23. 8.8CVE-2022-46862EPSS 0.4%

    Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.

  24. 8.8CVE-2023-25066EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.

  25. 8.8CVE-2022-43469EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions.

  26. 8.8CVE-2023-22375EPSS 0.4%

    Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to hijack the authentication and conduct arbitrary operations by having a logged-…

  27. 8.1CVE-2022-4138EPSS 0.4%

    A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a pr…

  28. 8.8CVE-2022-41134EPSS 0.3%

    Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.

  29. 8.8CVE-2022-34448EPSS 0.3%

    PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Cross-site Request Forgery vulnerability. An unauthenticated non-privileged user could potentially exploit the issue and perform any privileged state-changing a…

  30. 8.8CVE-2022-3568EPSS 0.6%

    The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHA…

  31. 8.8CVE-2022-41620EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions.

  32. 4.3CVE-2023-0726EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_edit_folder function. This makes it possible fo…

  33. 4.3CVE-2023-0725EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_clone_folder function. This makes it possible f…

  34. 4.3CVE-2023-0724EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_add_folder function. This makes it possible for…

  35. 4.3CVE-2023-0722EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_state function. This makes it possible for…

  36. 4.3CVE-2023-0685EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_unassign_folders function. This makes it possib…

  37. 6.5CVE-2023-0735EPSS 0.3%

    Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.

  38. 4.3CVE-2023-0730EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder_order function. This makes it possi…

  39. 4.3CVE-2023-0727EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_delete_folder function. This makes it possible …

  40. 4.3CVE-2023-0723EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_move_object function. This makes it possible fo…

  41. 4.3CVE-2023-0728EPSS 0.3%

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder function. This makes it possible fo…

  42. 5.4CVE-2022-2933EPSS 0.5%

    The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the zeromk_options_page function. This makes it possible for …

  43. 6.5CVE-2022-27628EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions.

  44. 6.5CVE-2023-0674EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-…

  45. 6.5CVE-2021-37234EPSS 0.4%

    Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API.

  46. 8.8CVE-2021-36570EPSS 0.7%

    Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.

  47. 8.8CVE-2021-36569EPSS 0.4%

    Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.

  48. 8.8CVE-2021-36444EPSS 0.6%

    Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.

  49. 8.8CVE-2021-36443EPSS 0.6%

    Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.

  50. 8.8CVE-2022-47132EPSS 0.9%

    A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.