cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 149

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2019-16569EPSS 0.7%

    A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials.

  2. 8.8CVE-2019-16565EPSS 0.8%

    A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing creden…

  3. 8.8CVE-2019-16560EPSS 0.9%

    A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file sys…

  4. 8.8CVE-2019-16553EPSS 0.9%

    A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.

  5. 8.8CVE-2019-16551EPSS 0.9%

    A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials.

  6. 8.8CVE-2019-16550EPSS 0.8%

    A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.

  7. 6.5CVE-2017-18107EPSS 0.4%

    Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery (CSRF) vulnerability. Please be aware that the …

  8. 8.8CVE-2014-0197EPSS 0.7%

    CFME: CSRF protection vulnerability via permissive check of the referrer header

  9. 8.1CVE-2019-13930EPSS 0.5%

    A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requ…

  10. 8.8CVE-2019-15934EPSS 0.9%

    Intesync Solismed 3.3sp has CSRF.

  11. 8.8CVE-2019-0398EPSS 0.5%

    Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to …

  12. 6.5CVE-2014-0026EPSS 0.4%

    katello-headpin is vulnerable to CSRF in REST API

  13. 4.3CVE-2019-4095EPSS 0.4%

    IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.

  14. 8.8CVE-2019-19685EPSS 0.5%

    RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions.

  15. 4.3CVE-2019-16752EPSS 0.4%

    An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious thr…

  16. 8.8CVE-2019-18346EPSS 1.0%

    A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administr…

  17. 6.5CVE-2019-19516ExploitEPSS 9.6%

    Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password.

  18. 8.8CVE-2019-19469EPSS 0.6%

    In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metacharacters. This may depend on weak default credentials.

  19. 5.3CVE-2019-19375EPSS 0.4%

    In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)

  20. 8.8CVE-2019-17590EPSS 0.6%

    The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper with the csrf token values. A remote attacker can exploit this by crafting a malicious page and disp…

  21. 6.1CVE-2019-18677EPSS 3.9%

    An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inapp…

  22. 6.5CVE-2019-16002EPSS 0.7%

    A vulnerability in the vManage web-based UI (web UI) of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insu…

  23. 6.5CVE-2011-3609EPSS 1.3%

    A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to …

  24. 8.8CVE-2013-6811EPSS 1.0%

    Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote …

  25. 8.8CVE-2019-19013EPSS 0.8%

    A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.

  26. 8.8CVE-2012-2079EPSS 0.5%

    A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.

  27. 8.8CVE-2015-3140ExploitEPSS 1.3%

    Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567

  28. 8.8CVE-2013-3312EPSS 0.9%

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the authentication of unspecified victims for requests that change (1) passwords or (2) firewall configuration, a…

  29. 8.8CVE-2019-16548EPSS 0.9%

    A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.

  30. 8.8CVE-2011-4952EPSS 0.6%

    cobbler: Web interface lacks CSRF protection when using Django framework

  31. 6.5CVE-2019-18651EPSS 0.7%

    A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML docume…

  32. 8.8CVE-2013-3366EPSS 0.9%

    Undocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_24Mhw3.

  33. 8.8CVE-2019-18884EPSS 0.7%

    index.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users.

  34. 6.5CVE-2013-3516EPSS 0.7%

    NETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and time, which allows attackers to guess the CSRF tokens.

  35. 6.5CVE-2012-4385ExploitEPSS 1.6%

    letodms 3.3.6 has CSRF via change password

  36. 4.3CVE-2014-3655EPSS 0.5%

    JBoss KeyCloak is vulnerable to soft token deletion via CSRF

  37. 8.8CVE-2010-3305EPSS 1.0%

    Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password.

  38. 8.8CVE-2019-17237EPSS 0.7%

    includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.

  39. 8.8CVE-2019-18411EPSS 2.3%

    Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unin…

  40. 8.8CVE-2019-18650EPSS 0.5%

    An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability.

  41. 7.5CVE-2019-8155EPSS 0.5%

    Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions.

  42. 8.0CVE-2019-8109EPSS 0.9%

    A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft a malicious CSRF payload that can result in arbitrary command execution.

  43. 6.5CVE-2013-6275ExploitEPSS 2.1%

    Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.

  44. 5.3CVE-2013-6365EPSS 1.1%

    Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

  45. 8.8CVE-2013-6364ExploitEPSS 2.1%

    Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

  46. 6.5CVE-2019-13497EPSS 0.7%

    One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests.

  47. 8.8CVE-2019-18206EPSS 0.5%

    A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload.

  48. 8.8CVE-2019-9926EPSS 1.9%

    An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewScriptReport.view CSRF vulnerability.

  49. 8.8CVE-2010-4241EPSS 0.8%

    Tiki Wiki CMS Groupware 5.2 has CSRF

  50. 8.8CVE-2013-4848EPSS 1.1%

    TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities.