cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 144

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2020-9042EPSS 0.6%

    In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request.

  2. 6.5CVE-2020-13868EPSS 0.4%

    An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

  3. 6.5CVE-2020-11682EPSS 0.6%

    Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application…

  4. 8.8CVE-2020-13786EPSS 0.7%

    D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF.

  5. 8.0CVE-2020-2196EPSS 0.9%

    Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.

  6. 6.5CVE-2020-2192EPSS 0.6%

    A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels.

  7. 8.8CVE-2020-13760EPSS 0.7%

    In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.

  8. 8.8CVE-2014-8942EPSS 0.5%

    Lexiglot through 2014-11-20 allows CSRF.

  9. 8.8CVE-2020-4018EPSS 0.6%

    The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.

  10. 8.8CVE-2020-13643EPSS 0.8%

    An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels…

  11. 8.8CVE-2020-13642EPSS 0.8%

    An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels…

  12. 8.8CVE-2020-13641EPSS 0.8%

    An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and re…

  13. 8.8CVE-2020-8168EPSS 0.7%

    We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse m…

  14. 8.8CVE-2020-13458EPSS 0.5%

    An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.

  15. 6.5CVE-2020-13416EPSS 0.5%

    An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery (CSRF) vulnerability for pass…

  16. 8.8CVE-2020-13412EPSS 0.6%

    An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSRF.

  17. 6.5CVE-2020-1103EPSS 2.2%

    An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF). When users are simultaneo…

  18. 8.8CVE-2019-20804EPSS 1.1%

    Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account.

  19. 6.5CVE-2020-13231EPSS 0.9%

    In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.

  20. 6.5CVE-2020-4286EPSS 0.5%

    IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID:…

  21. 8.8CVE-2020-12257EPSS 1.4%

    rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token. An attacker can leverage this vulnerability by creating a form (add a user, delete a user, or edit a …

  22. 8.1CVE-2019-20390EPSS 0.7%

    A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web pa…

  23. 8.8CVE-2020-5576EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606…

  24. 8.8CVE-2020-11069EPSS 0.7%

    In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malic…

  25. 8.8CVE-2020-12427EPSS 0.5%

    The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space.

  26. 8.8CVE-2020-11060ExploitEPSS 11%

    In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the expl…

  27. 7.4CVE-2020-5745EPSS 0.8%

    Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.

  28. 4.3CVE-2020-2186EPSS 0.6%

    A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances.

  29. 4.3CVE-2020-2184EPSS 44%

    A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.

  30. 8.8CVE-2020-8830EPSS 0.5%

    CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen.

  31. 8.8CVE-2020-8829EPSS 0.5%

    CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis.

  32. 8.1CVE-2020-7983EPSS 0.6%

    A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks.

  33. 6.5CVE-2020-5517EPSS 0.6%

    CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis.

  34. 8.8CVE-2019-19517EPSS 0.5%

    Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html form, as demonstrated by launching a scrapy process.

  35. 8.8CVE-2020-5335EPSS 0.5%

    RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to send arbitrary requ…

  36. 6.5CVE-2020-12626EPSS 2.0%

    An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.

  37. 8.8CVE-2019-0235ExploitEPSS 33%

    Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.

  38. 6.1CVE-2020-12462EPSS 0.5%

    The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.

  39. 8.0CVE-2017-18861EPSS 0.4%

    Certain NETGEAR devices are affected by CSRF. This affects ReadyNAS Surveillance 1.4.3-15-x86 and earlier and ReadyNAS Surveillance 1.1.4-5-ARM and earlier.

  40. 4.3CVE-2016-11055EPSS 0.3%

    Certain NETGEAR devices are affected by CSRF. This affects CM400 before 2017-01-11, CM600 before 2017-01-11, D1500 before 2017-01-11, D500 before 2017-01-11, DST6501 before 2017-01-11, JNR1010v1 before 2017-01-11, JWNR2000Tv3 before 2017-0…

  41. 7.4CVE-2018-21096EPSS 0.3%

    Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4, WNAP210v2 before 3.7.11.4, WNDAP350 before 3.7.11.4, WNDAP360 before 3.7.11.4, WNDAP660 …

  42. 8.8CVE-2019-4750EPSS 0.5%

    IBM Cloud App Management 2019.3.0 and 2019.4.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 173310.

  43. 8.8CVE-2017-18703EPSS 0.5%

    Certain NETGEAR devices are affected by CSRF. This affects D1500 before 1.0.0.25, D500 before 1.0.0.25, D6100 before 1.0.0.55, D7000 before 1.0.1.50, D7800 before 1.0.1.28, EX6100v2 before 1.0.1.60, EX6150v2 before 1.0.1.60, JNR1010v2 befo…

  44. 8.8CVE-2017-18708EPSS 0.5%

    Certain NETGEAR devices are affected by CSRF. This affects R8300 before 1.0.2.94 and R8500 before 1.0.2.94.

  45. 8.8CVE-2018-21160EPSS 0.7%

    NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.

  46. 8.8CVE-2018-21102EPSS 0.6%

    NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.

  47. 8.8CVE-2017-18749EPSS 0.5%

    Certain NETGEAR devices are affected by CSRF. This affects JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.44, R6050 before 1.0.1.10, R6100 before 1.0.1.16, R6220 before 1.1.0.50, R7500 before 1.0.0.112, R7500v2 …

  48. 8.8CVE-2017-18742EPSS 0.5%

    Certain NETGEAR devices are affected by CSRF. This affects JR6150 before 1.0.1.10, R6050 before 1.0.1.10, R6250 before 1.0.4.12, R6300v2 before 1.0.4.8, R6700 before 1.0.1.16, R6900 before 1.0.1.16, R7300DST before 1.0.0.54, R7900 before 1…

  49. 8.8CVE-2020-12076EPSS 0.7%

    The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.

  50. 8.8CVE-2020-10892EPSS 2.2%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…