cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 148

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2019-16513EPSS 1.0%

    An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests.

  2. 4.3CVE-2020-7210EPSS 1.0%

    Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.

  3. 8.8CVE-2011-3612EPSS 0.9%

    Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.

  4. 8.8CVE-2011-3582EPSS 0.5%

    A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the administrator functions.

  5. 8.8CVE-2020-6849EPSS 1.3%

    The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.

  6. 8.8CVE-2019-3864EPSS 0.4%

    A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged…

  7. 5.3CVE-2020-5397EPSS 2.6%

    Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoi…

  8. 8.8CVE-2019-19854EPSS 0.5%

    An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the Origin header (which must match the request origin). This is problematic in conj…

  9. 8.8CVE-2019-18271EPSS 0.6%

    OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request forgery that may be introduced on the PI Vision administration site.

  10. 8.8CVE-2020-2098EPSS 1.0%

    A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins.

  11. 8.8CVE-2020-2093EPSS 0.8%

    A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content to an attacker-specified recipient.

  12. 8.8CVE-2020-2090EPSS 0.8%

    A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another metho…

  13. 6.5CVE-2020-5502EPSS 0.4%

    phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

  14. 4.3CVE-2020-5501EPSS 0.4%

    phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.

  15. 8.8CVE-2011-2934EPSS 0.5%

    A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive transactions.

  16. 6.5CVE-2014-9382EPSS 0.8%

    Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation

  17. 8.8CVE-2019-14304EPSS 0.7%

    Ricoh SP C250DN 1.06 devices allow CSRF.

  18. 6.5CVE-2019-20178EPSS 0.4%

    Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.

  19. 8.1CVE-2019-6319EPSS 0.6%

    HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a Cross-Site Request Forgery (CSRF) vulnerability that could lead to a denial …

  20. 8.8CVE-2020-6167EPSS 0.9%

    A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo.

  21. 8.1CVE-2019-6320EPSS 0.6%

    Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a Cross-Site Request Forgery (CSRF) vulnerability that could lead to a…

  22. 6.5CVE-2011-5250EPSS 0.7%

    Snare for Linux before 1.7.0 has CSRF in the web interface.

  23. 4.3CVE-2019-20077EPSS 0.4%

    The Typesetter CMS 5.1 logout functionality is affected by a CSRF vulnerability. The logout function of the admin panel is not protected by any CSRF tokens. An attacker can logout the user using this vulnerability.

  24. 6.5CVE-2014-5516EPSS 1.3%

    Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address v…

  25. 6.5CVE-2014-3590EPSS 0.5%

    Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.

  26. 8.8CVE-2013-3935EPSS 0.5%

    Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspeci…

  27. 6.5CVE-2015-5595ExploitEPSS 1.5%

    Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service (resource consumption).

  28. 6.5CVE-2019-12273EPSS 0.5%

    OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a *.outsystemsenterprise.com domain name.) NOTE: The ve…

  29. 6.5CVE-2013-0196EPSS 0.4%

    A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header…

  30. 8.8CVE-2019-19737EPSS 0.5%

    MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks.

  31. 6.5CVE-2019-20071EPSS 0.8%

    On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.

  32. 8.8CVE-2014-3136ExploitEPSS 2.9%

    Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via unspecified vec…

  33. 6.5CVE-2013-4665ExploitEPSS 1.3%

    SPBAS Business Automation Software 2012 has CSRF.

  34. 8.8CVE-2019-19995EPSS 0.7%

    A CSRF issue was discovered on Intelbras IWR 3000N 1.8.7 devices, leading to complete control of the router, as demonstrated by v1/system/user.

  35. 8.8CVE-2019-16326EPSS 0.6%

    D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit this in conjunction with CVE-2019-16327 to enable remote router management and device compromise. NOTE: this is an end-of…

  36. 8.8CVE-2019-6030EPSS 0.7%

    Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  37. 8.8CVE-2019-6027EPSS 0.7%

    Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  38. 5.4CVE-2019-19981EPSS 0.6%

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.

  39. 8.8CVE-2019-19979EPSS 0.6%

    A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS.

  40. 4.3CVE-2019-4736EPSS 0.4%

    IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172706.

  41. 4.3CVE-2019-4231EPSS 0.7%

    IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159356.

  42. 8.8CVE-2018-1934EPSS 0.4%

    IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153179.

  43. 9.0CVE-2019-19915EPSS 0.9%

    The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save a…

  44. 8.8CVE-2019-17633EPSS 0.8%

    For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a publ…

  45. 6.5CVE-2019-19833ExploitEPSS 15%

    In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).

  46. 8.8CVE-2019-19832EPSS 0.7%

    Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The frmUserName value must have a unique name.)

  47. 8.8CVE-2019-11657EPSS 0.5%

    Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. The vulnerability could be exploited to perform CSRF attack.

  48. 8.8CVE-2019-16575EPSS 0.9%

    A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capt…

  49. 8.8CVE-2019-16573EPSS 0.9%

    A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, captur…

  50. 8.8CVE-2019-16570EPSS 0.9%

    A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server.