cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 141

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2019-19289EPSS 0.5%

    A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link.

  2. 8.8CVE-2020-8282EPSS 0.9%

    A security issue was found in EdgePower 24V/54V firmware v1.7.0 and earlier where, due to missing CSRF protections, an attacker would have been able to perform unauthorized remote code execution.

  3. 8.8CVE-2020-28858EPSS 1.1%

    OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions.

  4. 8.8CVE-2020-29254EPSS 1.5%

    TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulner…

  5. 3.5CVE-2020-28838EPSS 0.4%

    Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart.

  6. 8.8CVE-2020-35135EPSS 0.9%

    The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF.

  7. 8.1CVE-2020-2321EPSS 0.8%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project.

  8. 6.3CVE-2020-14369EPSS 0.3%

    This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forg…

  9. 8.8CVE-2020-29458EPSS 0.7%

    Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.

  10. 6.5CVE-2020-4127EPSS 0.5%

    HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or use an intranet user's system to access internal systems from the internet. Fixes …

  11. 6.5CVE-2020-17901EPSS 0.4%

    Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.

  12. 8.8CVE-2020-7780EPSS 0.7%

    This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older …

  13. 8.8CVE-2020-26936EPSS 0.5%

    Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.

  14. 8.8CVE-2020-13620EPSS 0.5%

    Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform administrative actions such as modifying the configuration.

  15. 6.5CVE-2020-25472EPSS 0.5%

    SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users.

  16. 6.5CVE-2020-5641EPSS 0.6%

    Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention …

  17. 4.3CVE-2020-13350EPSS 0.8%

    CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0, <13.4.5,<13.3.9.

  18. 8.8CVE-2020-28649EPSS 0.8%

    The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.

  19. 8.8CVE-2020-7332EPSS 0.6%

    Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacker to execute arbitrary HTML code due to incorrect security configuration.

  20. 8.8CVE-2019-7357EPSS 1.4%

    Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.

  21. 8.8CVE-2020-27146EPSS 0.3%

    The Core component of TIBCO Software Inc.'s TIBCO iProcess Workspace (Browser) contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a Cross Site Request Forgery (CSRF) attack on the …

  22. 8.8CVE-2020-27016EPSS 1.9%

    Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into …

  23. 4.8CVE-2020-4651EPSS 0.3%

    IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website tru…

  24. 8.8CVE-2020-15259EPSS 1.0%

    ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page contain…

  25. 8.8CVE-2020-27692EPSS 0.5%

    The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings (res…

  26. 6.5CVE-2020-22273EPSS 0.4%

    Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Settings)

  27. 4.3CVE-2020-2303EPSS 0.7%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using at…

  28. 4.3CVE-2020-28040EPSS 1.1%

    WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.

  29. 8.8CVE-2020-11485EPSS 0.8%

    NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, …

  30. 8.8CVE-2020-16256EPSS 0.7%

    The API on Winston 1.5.4 devices is vulnerable to CSRF.

  31. 8.8CVE-2020-27975EPSS 0.6%

    osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.

  32. 4.3CVE-2020-24847EPSS 0.4%

    A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering …

  33. 8.8CVE-2020-18129EPSS 0.6%

    A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.

  34. 8.8CVE-2020-24033EPSS 1.0%

    An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all sett…

  35. 8.8CVE-2020-3456EPSS 0.6%

    A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerabili…

  36. 6.5CVE-2020-5790EPSS 2.3%

    Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.

  37. 8.8CVE-2020-12502EPSS 1.0%

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G…

  38. 8.8CVE-2020-5642EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  39. 6.5CVE-2020-4773EPSS 0.6%

    A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted actions on the web application while they are currently authentica…

  40. 8.8CVE-2020-26912EPSS 0.6%

    Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.…

  41. 8.8CVE-2020-26522EPSS 0.8%

    A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.

  42. 8.8CVE-2020-26802EPSS 0.6%

    forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeover.

  43. 4.3CVE-2020-2296EPSS 0.8%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects.

  44. 6.5CVE-2020-2295EPSS 0.5%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin.

  45. 7.1CVE-2020-25263EPSS 0.6%

    PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted.

  46. 4.3CVE-2020-25262EPSS 0.5%

    PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

  47. 6.5CVE-2020-25986EPSS 0.6%

    A Cross Site Request Forgery (CSRF) vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user.

  48. 8.1CVE-2020-12123EPSS 0.4%

    CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoints, because these endpoints do not contain CSRF tokens. If a user is authenticated in the router p…

  49. 8.8CVE-2020-5786EPSS 8.6%

    Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.

  50. 6.5CVE-2020-24570EPSS 0.5%

    An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resultant SSRF) in the com_mb24proxy module, allowing attackers to steal session information from logged-in users with a cr…