cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 153

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2016-10914EPSS 0.7%

    The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.

  2. 6.5CVE-2015-9332EPSS 0.6%

    The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.

  3. 8.8CVE-2014-10381EPSS 0.7%

    The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.

  4. 8.8CVE-2011-5328EPSS 0.7%

    The user-access-manager plugin before 1.2 for WordPress has CSRF.

  5. 8.8CVE-2019-15229EPSS 0.7%

    FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.

  6. 8.8CVE-2019-15150EPSS 1.2%

    In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.

  7. 8.8CVE-2019-15115EPSS 0.7%

    The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.

  8. 8.8CVE-2019-15114EPSS 0.7%

    The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.

  9. 8.8CVE-2019-15113EPSS 0.7%

    The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.

  10. 8.8CVE-2018-20974EPSS 0.6%

    The js-jobs plugin before 1.0.7 for WordPress has CSRF.

  11. 8.8CVE-2018-20972EPSS 0.6%

    The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.

  12. 8.8CVE-2018-20971EPSS 0.6%

    The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.

  13. 8.8CVE-2017-18547EPSS 0.6%

    The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.

  14. 8.8CVE-2017-18546EPSS 0.6%

    The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.

  15. 8.8CVE-2017-18544EPSS 0.6%

    The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.

  16. 8.8CVE-2015-9322EPSS 0.7%

    The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.

  17. 8.8CVE-2019-13516EPSS 0.7%

    In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.

  18. 8.8CVE-2018-14668EPSS 0.7%

    In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.

  19. 8.0CVE-2019-15062EPSS 0.6%

    An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account.…

  20. 8.1CVE-2019-14526EPSS 0.7%

    An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, …

  21. 8.8CVE-2019-14216EPSS 0.8%

    An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a…

  22. 8.8CVE-2019-10199EPSS 0.5%

    It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted dom…

  23. 8.8CVE-2018-20968EPSS 0.6%

    The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.

  24. 8.8CVE-2018-20967EPSS 0.6%

    The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.

  25. 8.8CVE-2017-18513EPSS 0.6%

    The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.

  26. 8.8CVE-2017-18512EPSS 0.6%

    The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.

  27. 8.8CVE-2017-18511EPSS 0.6%

    The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.

  28. 8.8CVE-2017-18510EPSS 0.6%

    The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.

  29. 8.8CVE-2016-10885EPSS 0.7%

    The wp-editor plugin before 1.2.6 for WordPress has CSRF.

  30. 8.8CVE-2016-10884EPSS 0.7%

    The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.

  31. 6.5CVE-2016-10883EPSS 0.6%

    The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.

  32. 8.8CVE-2016-10882EPSS 0.7%

    The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.

  33. 8.8CVE-2015-9309EPSS 0.7%

    The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.

  34. 8.8CVE-2015-9308EPSS 0.7%

    The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.

  35. 8.8CVE-2015-9307EPSS 0.7%

    The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.

  36. 8.8CVE-2013-7476EPSS 0.7%

    The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.

  37. 8.8CVE-2019-11207EPSS 0.7%

    The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site sc…

  38. 8.8CVE-2018-20964EPSS 0.7%

    The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.

  39. 8.8CVE-2017-18504EPSS 0.7%

    The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.

  40. 8.8CVE-2016-10876EPSS 0.7%

    The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

  41. 8.8CVE-2016-10874EPSS 0.7%

    The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

  42. 8.8CVE-2019-14933EPSS 0.6%

    Bagisto 0.1.5 allows CSRF under /admin URIs.

  43. 6.1CVE-2016-10865EPSS 0.5%

    The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.

  44. 5.4CVE-2017-18485EPSS 0.4%

    Cognitoys Dino devices allow profiles_add.html CSRF.

  45. 8.8CVE-2016-10863EPSS 0.6%

    Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.

  46. 8.8CVE-2016-10862EPSS 0.6%

    Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.

  47. 8.8CVE-2015-9292EPSS 0.6%

    6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).

  48. 5.7CVE-2019-14683EPSS 0.7%

    The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.

  49. 4.3CVE-2019-14682EPSS 0.7%

    The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.

  50. 8.8CVE-2019-14681EPSS 0.8%

    The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.