cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 146

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2020-10498EPSS 0.5%

    CSRF in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a category, given the id, via a crafted request.

  2. 6.5CVE-2020-10497EPSS 0.5%

    CSRF in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a category via a crafted request.

  3. 4.3CVE-2020-10496EPSS 0.5%

    CSRF in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article, given the id, via a crafted request.

  4. 4.3CVE-2020-10495EPSS 0.5%

    CSRF in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article template, given the id, via a crafted request.

  5. 4.3CVE-2020-10494EPSS 0.5%

    CSRF in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a news article, given the id, via a crafted request.

  6. 4.3CVE-2020-10493EPSS 0.5%

    CSRF in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a glossary term, given the id, via a crafted request.

  7. 4.3CVE-2020-10492EPSS 0.5%

    CSRF in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article template via a crafted request.

  8. 4.3CVE-2020-10491EPSS 0.5%

    CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a department via a crafted request.

  9. 4.3CVE-2020-10490EPSS 0.5%

    CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request.

  10. 4.3CVE-2020-10489EPSS 0.5%

    CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a ticket via a crafted request.

  11. 4.3CVE-2020-10488EPSS 0.5%

    CSRF in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a news article via a crafted request.

  12. 4.3CVE-2020-10487EPSS 0.5%

    CSRF in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a glossary term via a crafted request.

  13. 4.3CVE-2020-10486EPSS 0.5%

    CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a comment via a crafted request.

  14. 4.3CVE-2020-10485EPSS 0.5%

    CSRF in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article via a crafted request.

  15. 4.3CVE-2020-10484EPSS 0.5%

    CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request.

  16. 4.3CVE-2020-10483EPSS 0.5%

    CSRF in admin/ajax-hub.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to post a comment on any article via a crafted request.

  17. 4.3CVE-2020-10482EPSS 0.5%

    CSRF in admin/add-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new article template via a crafted request.

  18. 4.3CVE-2020-10481EPSS 0.5%

    CSRF in admin/add-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new glossary term via a crafted request.

  19. 4.3CVE-2020-10480EPSS 0.6%

    CSRF in admin/add-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new category via a crafted request.

  20. 4.3CVE-2020-10479EPSS 0.5%

    CSRF in admin/add-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new news article via a crafted request.

  21. 8.8CVE-2020-10478EPSS 1.2%

    CSRF in admin/manage-settings.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to change the global settings, potentially gaining code execution or causing a denial of service, via a crafted request.

  22. 9.8CVE-2020-10181KEVEPSS 15%

    goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.

  23. 4.3CVE-2019-16107EPSS 0.4%

    Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.

  24. 4.3CVE-2020-6206EPSS 0.4%

    SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross…

  25. 4.3CVE-2020-2147EPSS 0.8%

    A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.

  26. 4.3CVE-2020-2141EPSS 0.6%

    A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce.

  27. 8.8CVE-2020-9454EPSS 1.1%

    A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new ro…

  28. 8.8CVE-2019-17642EPSS 1.7%

    An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a POST to centreon-autodiscovery-server/views/scan/ajax/call.php in the Autodiscov…

  29. 7.1CVE-2020-3148EPSS 0.5%

    A vulnerability in the web-based interface of Cisco Prime Network Registrar (CPNR) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to ins…

  30. 8.8CVE-2020-10057EPSS 0.9%

    GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token" is used as a CSRF protection mechanism, but without validation that …

  31. 8.8CVE-2020-7988EPSS 0.7%

    An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack…

  32. 8.8CVE-2019-20487EPSS 0.5%

    An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request (exploitable directly or through CSRF), as demonstrated by the set…

  33. 8.8CVE-2015-1583EPSS 1.2%

    Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/c…

  34. 8.8CVE-2020-5402EPSS 0.5%

    In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.

  35. 8.8CVE-2015-5686EPSS 0.5%

    Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session.

  36. 4.3CVE-2019-4726EPSS 0.5%

    IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. I…

  37. 6.5CVE-2019-19987EPSS 0.5%

    An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker can exploit the vulnerability to abuse functionalities such as change password, a…

  38. 8.8CVE-2020-9394EPSS 0.7%

    An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.

  39. 5.3CVE-2020-9018EPSS 0.4%

    LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.

  40. 8.8CVE-2019-20480EPSS 0.4%

    In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary changes in the "admin panel" because there is no CSRF protection.

  41. 8.8CVE-2020-9341EPSS 0.6%

    CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI.

  42. 8.8CVE-2012-2629ExploitEPSS 2.3%

    Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator account v…

  43. 8.8CVE-2020-3114EPSS 0.6%

    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerabilit…

  44. 8.8CVE-2019-12437EPSS 0.7%

    In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,

  45. 4.3CVE-2019-12246EPSS 0.7%

    SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.

  46. 6.5CVE-2020-9271EPSS 0.4%

    ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.

  47. 8.8CVE-2020-9270EPSS 0.5%

    ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.

  48. 6.5CVE-2020-9267EPSS 0.5%

    SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php.

  49. 6.5CVE-2020-9266EPSS 0.5%

    SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.

  50. 8.8CVE-2020-6844EPSS 0.7%

    In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts.