cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 131

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2022-20613EPSS 1.0%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

  2. 4.3CVE-2022-20612EPSS 1.8%

    A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

  3. 8.8CVE-2021-41597EPSS 1.0%

    SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.

  4. 8.8CVE-2021-37198EPSS 0.4%

    A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used)…

  5. 8.8CVE-2021-25053EPSS 0.7%

    The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

  6. 8.8CVE-2021-25052ExploitEPSS 3.0%

    The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

  7. 8.8CVE-2021-25051EPSS 0.8%

    The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

  8. 9.8CVE-2021-25032ExploitEPSS 7.1%

    The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure…

  9. 8.8CVE-2021-46147EPSS 0.5%

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.

  10. 8.8CVE-2021-34086EPSS 0.5%

    In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests.

  11. 4.8CVE-2021-46080EPSS 0.6%

    A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Scripting Vulnerability.

  12. 8.8CVE-2021-20165EPSS 0.6%

    Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that do make use of CSRF tokens are trivially bypassable as the s…

  13. 6.5CVE-2020-29292EPSS 0.4%

    iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses.

  14. 8.8CVE-2020-21236EPSS 0.6%

    A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.

  15. 8.8CVE-2020-20945EPSS 0.6%

    A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts.

  16. 4.3CVE-2020-20943EPSS 0.4%

    A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL.

  17. 5.4CVE-2021-24988EPSS 0.3%

    The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missin…

  18. 8.8CVE-2021-4168EPSS 0.6%

    showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

  19. 4.3CVE-2021-4162EPSS 0.4%

    archivy is vulnerable to Cross-Site Request Forgery (CSRF)

  20. 6.5CVE-2020-20595EPSS 0.5%

    A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add.

  21. 8.0CVE-2020-20593EPSS 0.4%

    A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.

  22. 8.8CVE-2021-36886EPSS 0.6%

    Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).

  23. 4.3CVE-2021-43158EPSS 0.5%

    In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart.

  24. 6.5CVE-2021-43156EPSS 0.5%

    In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book.

  25. 7.5CVE-2021-24981EPSS 0.8%

    The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.

  26. 4.3CVE-2021-43846EPSS 0.6%

    `solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to a…

  27. 8.8CVE-2021-36887EPSS 0.5%

    Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteau…

  28. 8.8CVE-2021-4131EPSS 0.6%

    livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

  29. 8.8CVE-2021-4130EPSS 0.5%

    snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

  30. 6.5CVE-2021-26800EPSS 0.4%

    Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account.

  31. 8.8CVE-2021-41260EPSS 0.4%

    Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon …

  32. 6.5CVE-2021-4123EPSS 0.5%

    livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

  33. 8.8CVE-2021-45017EPSS 0.4%

    Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add M…

  34. 4.3CVE-2021-44942EPSS 0.4%

    glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF vulnerability to trick the administrator to click, an attacker can add a blacklis…

  35. 8.0CVE-2021-24945EPSS 0.6%

    The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email a…

  36. 9.0CVE-2021-24922EPSS 0.6%

    The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scr…

  37. 4.3CVE-2021-24836EPSS 0.4%

    The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them

  38. 4.3CVE-2021-24818EPSS 0.4%

    The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values

  39. 6.5CVE-2021-24795EPSS 0.5%

    The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.

  40. 4.3CVE-2021-24790EPSS 0.4%

    The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users…

  41. 6.5CVE-2021-24784EPSS 0.5%

    The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack.

  42. 4.3CVE-2021-24780EPSS 0.4%

    The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any ro…

  43. 4.3CVE-2021-4092EPSS 0.4%

    yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)

  44. 4.3CVE-2021-4082EPSS 0.4%

    pimcore is vulnerable to Cross-Site Request Forgery (CSRF)

  45. 6.5CVE-2021-4033EPSS 0.5%

    kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

  46. 8.8CVE-2020-19682EPSS 0.5%

    A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.

  47. 6.5CVE-2021-4049EPSS 0.4%

    livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

  48. 8.8CVE-2021-31631EPSS 0.6%

    b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to escalate privileges.

  49. 8.8CVE-2021-35242EPSS 0.8%

    Serv-U server responds with valid CSRFToken when the request contains only Session.

  50. 8.0CVE-2021-24914EPSS 0.5%

    The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (incl…