cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 152

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2017-18607EPSS 0.7%

    The avada theme before 5.1.5 for WordPress has CSRF.

  2. 6.5CVE-2019-10253EPSS 0.7%

    A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/…

  3. 8.8CVE-2019-16099EPSS 0.6%

    Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows CSRF via JSON data to a .swf file.

  4. 6.5CVE-2019-15128EPSS 0.7%

    iF.SVNAdmin through 1.6.2 allows svnadmin/usercreate.php CSRF to create a user.

  5. 8.8CVE-2019-16059EPSS 0.6%

    Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page.

  6. 8.8CVE-2019-15868EPSS 0.7%

    The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.

  7. 8.8CVE-2019-15865EPSS 0.7%

    The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.

  8. 8.8CVE-2019-15841EPSS 0.7%

    The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.

  9. 8.8CVE-2019-15840EPSS 0.7%

    The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.

  10. 8.8CVE-2019-15835EPSS 0.7%

    The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.

  11. 8.8CVE-2019-15834EPSS 0.7%

    The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.

  12. 8.8CVE-2019-15832EPSS 0.8%

    The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.

  13. 8.8CVE-2019-15831EPSS 0.7%

    The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.

  14. 8.8CVE-2019-15828EPSS 0.8%

    The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.

  15. 8.8CVE-2015-9380EPSS 0.8%

    The photo-gallery plugin before 1.2.42 for WordPress has CSRF.

  16. 8.8CVE-2019-15781EPSS 0.7%

    The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.

  17. 8.8CVE-2019-15779EPSS 0.7%

    The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.

  18. 8.8CVE-2019-15770EPSS 0.7%

    The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.

  19. 8.8CVE-2019-15769EPSS 0.8%

    The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.

  20. 6.5CVE-2019-10057EPSS 0.4%

    Various Lexmark products have CSRF.

  21. 8.8CVE-2019-15496EPSS 0.6%

    MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.

  22. 8.8CVE-2019-10384EPSS 1.6%

    Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

  23. 8.8CVE-2019-11457EPSS 1.2%

    Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and …

  24. 8.8CVE-2019-15660EPSS 0.7%

    The wp-members plugin before 3.2.8 for WordPress has CSRF.

  25. 6.5CVE-2019-15648EPSS 0.6%

    The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.

  26. 8.8CVE-2019-15645EPSS 0.7%

    The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.

  27. 8.8CVE-2018-21006EPSS 0.7%

    The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.

  28. 8.8CVE-2018-21002EPSS 0.7%

    The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.

  29. 8.8CVE-2015-9343EPSS 0.7%

    The wp-rollback plugin before 1.2.3 for WordPress has CSRF.

  30. 6.5CVE-2019-15515EPSS 0.6%

    Discourse 2.3.2 sends the CSRF token in the query string.

  31. 4.3CVE-2019-8447EPSS 0.7%

    The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.

  32. 4.3CVE-2019-14999EPSS 0.6%

    The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site R…

  33. 4.3CVE-2019-11588EPSS 0.8%

    The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site …

  34. 6.5CVE-2019-11587EPSS 0.8%

    Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request…

  35. 4.3CVE-2019-11586EPSS 0.6%

    The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) v…

  36. 8.8CVE-2019-15491EPSS 0.6%

    openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.

  37. 8.8CVE-2019-15329EPSS 0.7%

    The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.

  38. 4.3CVE-2014-10382EPSS 0.5%

    The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.

  39. 8.8CVE-2016-10918EPSS 0.7%

    The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.

  40. 8.8CVE-2019-13477EPSS 0.7%

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.

  41. 8.8CVE-2019-12624ExploitEPSS 18%

    A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary act…

  42. 8.8CVE-2017-18521EPSS 0.7%

    The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.

  43. 8.8CVE-2016-10903EPSS 0.7%

    The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.

  44. 8.8CVE-2016-10902EPSS 0.7%

    The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.

  45. 6.5CVE-2019-4167EPSS 0.5%

    IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158700.

  46. 8.8CVE-2019-4117EPSS 0.6%

    IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158116.

  47. 8.8CVE-2017-18523EPSS 0.7%

    The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.

  48. 8.8CVE-2019-15238EPSS 0.7%

    The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.

  49. 8.8CVE-2017-18569EPSS 0.7%

    The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.

  50. 8.8CVE-2016-10915EPSS 0.7%

    The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.