cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 147

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2013-4227EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users …

  2. 8.8CVE-2020-5530EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  3. 6.5CVE-2020-1692EPSS 0.6%

    Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.

  4. 5.5CVE-2013-4792EPSS 0.3%

    PrestaShop before 1.4.11 allows logout CSRF.

  5. 8.8CVE-2020-1977EPSS 0.5%

    Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This iss…

  6. 8.8CVE-2020-2116EPSS 0.7%

    A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, c…

  7. 4.7CVE-2019-20100EPSS 1.0%

    The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2…

  8. 4.3CVE-2019-20099EPSS 0.7%

    The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into makin…

  9. 4.3CVE-2019-20098EPSS 0.8%

    The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into maki…

  10. 6.3CVE-2012-6721EPSS 0.3%

    Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Forum, (2) Event, and (3) Classifieds plugins in SocialEngine before 4.2.4.

  11. 4.3CVE-2019-19668EPSS 0.4%

    A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that are used on the server via RAPR/TriggerServerFunction.html.

  12. 6.5CVE-2019-19669EPSS 0.4%

    A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and update the upload forms via RAPR/TriggerServerFunction.html.

  13. 5.4CVE-2019-19667EPSS 0.4%

    A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP address via RAPR/BlockedClients.html.

  14. 4.3CVE-2019-19666EPSS 0.4%

    A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can create/update event notices via RAPR/EventNoticesSet.html.

  15. 7.1CVE-2019-19664EPSS 0.4%

    A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGeneralSet.html.

  16. 6.5CVE-2019-19662EPSS 0.4%

    A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Delete accounts via RAPR/TriggerServerFunction.html.

  17. 8.8CVE-2013-2109EPSS 2.0%

    WordPress plugin wp-cleanfix has Remote Code Execution

  18. 5.4CVE-2013-2108ExploitEPSS 2.2%

    WordPress WP Cleanfix Plugin 2.4.4 has CSRF

  19. 6.5CVE-2019-19665EPSS 0.4%

    A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server FTP settings at RAPR/FTPSettingsSet.html.

  20. 6.5CVE-2019-19663EPSS 0.4%

    A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after exploiting it at RAPR/FolderSetsSet.html.

  21. 6.5CVE-2019-19660EPSS 0.4%

    A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html.

  22. 8.8CVE-2019-19659EPSS 0.5%

    A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a user account by changing the password, update users' details, and escalate privil…

  23. 8.8CVE-2019-20059EPSS 0.9%

    payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the que…

  24. 8.8CVE-2014-2225ExploitEPSS 1.3%

    Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new admin user via a request…

  25. 8.8CVE-2011-1085EPSS 0.5%

    CSRF vulnerability in Smoothwall Express 3.

  26. 8.8CVE-2014-5288ExploitEPSS 1.6%

    A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.

  27. 8.8CVE-2013-3568ExploitEPSS 25%

    Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.

  28. 8.8CVE-2012-6297EPSS 1.7%

    Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial of Service.

  29. 8.8CVE-2020-8658EPSS 9.9%

    The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, re…

  30. 4.3CVE-2019-20405EPSS 0.6%

    The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability.

  31. 6.5CVE-2019-20401EPSS 0.8%

    Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities.

  32. 8.8CVE-2011-0525EPSS 0.5%

    Batavi before 1.0 has CSRF.

  33. 8.8CVE-2019-4613EPSS 0.5%

    IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 168524.

  34. 6.5CVE-2020-8615ExploitEPSS 11%

    A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).

  35. 9.6CVE-2019-10784EPSS 3.6%

    phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a…

  36. 8.8CVE-2013-7053ExploitEPSS 3.4%

    D-Link DIR-100 4.03B07: cli.cgi CSRF

  37. 6.5CVE-2020-8505ExploitEPSS 1.1%

    School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.

  38. 6.5CVE-2020-8504ExploitEPSS 1.1%

    School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.

  39. 6.5CVE-2019-7654EPSS 0.9%

    Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding another admin user via enginemanager/server…

  40. 8.8CVE-2020-7965EPSS 0.6%

    flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-u…

  41. 6.5CVE-2020-8425ExploitEPSS 1.2%

    Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.

  42. 8.8CVE-2020-8424ExploitEPSS 1.5%

    Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php.

  43. 8.8CVE-2020-8420EPSS 0.7%

    An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.

  44. 8.8CVE-2020-8419EPSS 0.5%

    An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.

  45. 8.8CVE-2020-8417EPSS 12%

    The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.

  46. 8.8CVE-2013-3093EPSS 0.7%

    ASUS RT-N56U devices allow CSRF.

  47. 8.8CVE-2015-5483EPSS 1.6%

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modif…

  48. 6.5CVE-2013-4865ExploitEPSS 1.7%

    Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authentication of users for requests that install arbitrary firmware via the squashfs p…

  49. 8.8CVE-2020-7991ExploitEPSS 3.1%

    Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.

  50. 6.5CVE-2014-2050EPSS 1.5%

    Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header.