cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 143

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2016-11085EPSS 1.0%

    php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.

  2. 7.6CVE-2020-7304EPSS 0.5%

    Cross site request forgery vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attacker to embed a CRSF script via adding a new label.

  3. 4.3CVE-2020-2237EPSS 0.7%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a project at a previous git revision.

  4. 6.5CVE-2020-2235EPSS 0.9%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through anothe…

  5. 8.8CVE-2020-7029EPSS 0.4%

    A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attack…

  6. 8.8CVE-2020-12781EPSS 0.5%

    Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.

  7. 8.1CVE-2020-16253EPSS 0.5%

    The PgHero gem through 2.6.0 for Ruby allows CSRF.

  8. 4.3CVE-2020-16252EPSS 0.4%

    The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.

  9. 7.6CVE-2020-15135EPSS 0.7%

    save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed ver…

  10. 8.8CVE-2020-5615EPSS 0.7%

    Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  11. 8.8CVE-2020-5770EPSS 0.7%

    Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.

  12. 5.9CVE-2020-14319EPSS 0.3%

    It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not instigated or bypassed. For example authorised users using an older browser with Ado…

  13. 8.8CVE-2020-10984EPSS 0.7%

    Gambio GX before 4.0.1.0 allows admin/admin.php CSRF.

  14. 8.8CVE-2020-5611EPSS 1.2%

    Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  15. 8.1CVE-2020-15882EPSS 0.6%

    A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database.

  16. 6.5CVE-2020-5767EPSS 0.9%

    Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.

  17. 8.8CVE-2020-11438EPSS 0.6%

    LibreHealth EMR v2.0.0 is affected by systemic CSRF.

  18. 6.3CVE-2020-15700EPSS 0.5%

    An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability.

  19. 6.3CVE-2020-15695EPSS 0.5%

    An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.

  20. 8.8CVE-2019-12784EPSS 0.7%

    An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login att…

  21. 8.8CVE-2020-6289EPSS 0.4%

    SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site.

  22. 8.8CVE-2020-15711EPSS 0.5%

    In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.

  23. 6.5CVE-2020-10986EPSS 0.6%

    A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page.

  24. 6.5CVE-2020-15600ExploitEPSS 1.9%

    An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.

  25. 5.4CVE-2020-15516EPSS 0.4%

    The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.

  26. 4.3CVE-2020-8166EPSS 1.7%

    A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.

  27. 4.3CVE-2020-2215EPSS 0.7%

    A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password.

  28. 4.3CVE-2020-2203EPSS 0.7%

    A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.

  29. 8.8CVE-2020-5904EPSS 0.6%

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists…

  30. 8.8CVE-2020-5900EPSS 0.5%

    In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.

  31. 4.3CVE-2020-15400EPSS 0.4%

    CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.

  32. 4.3CVE-2019-20415EPSS 0.7%

    Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.3, and from ve…

  33. 6.5CVE-2020-15043EPSS 0.4%

    iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP addresses.

  34. 4.3CVE-2019-20411EPSS 0.7%

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 b…

  35. 8.8CVE-2020-15046ExploitEPSS 2.3%

    The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88.

  36. 8.8CVE-2020-15014EPSS 0.5%

    pramodmahato BlogCMS through 2019-12-31 has admin/changepass.php CSRF.

  37. 6.5CVE-2020-13157EPSS 0.6%

    modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is not needed.

  38. 6.5CVE-2020-13156EPSS 0.6%

    modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI.

  39. 8.8CVE-2020-13155EPSS 0.7%

    clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI.

  40. 6.5CVE-2020-13426EPSS 1.2%

    The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.

  41. 8.8CVE-2020-14203EPSS 0.5%

    WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery (CSRF) attack against administrative users within the /ibi_apps/WFServlet(.ibfs) endpoint. The impact may be creation of an administrative user. It can also be ex…

  42. 8.8CVE-2019-20891EPSS 0.5%

    WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.

  43. 6.1CVE-2016-11084EPSS 0.3%

    An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.

  44. 8.8CVE-2017-18903EPSS 0.4%

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.

  45. 6.5CVE-2020-8167EPSS 1.5%

    A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

  46. 8.8CVE-2019-20865EPSS 0.5%

    An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.

  47. 8.8CVE-2019-20841EPSS 0.4%

    An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks.

  48. 8.8CVE-2020-14432EPSS 0.4%

    Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS8…

  49. 8.8CVE-2020-7503EPSS 0.6%

    A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to execute malicious commands on behalf of a legitimate user when xsrf-token data is interce…

  50. 8.8CVE-2019-19109EPSS 0.7%

    The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.