cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 155

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2018-12628EPSS 0.7%

    An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges.

  2. 6.5CVE-2019-12923EPSS 0.6%

    In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This co…

  3. 8.8CVE-2019-13401EPSS 0.6%

    Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.

  4. 8.8CVE-2019-13183EPSS 0.8%

    Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

  5. 8.8CVE-2019-13370EPSS 0.6%

    index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.

  6. 8.8CVE-2019-5984EPSS 1.0%

    Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  7. 8.8CVE-2019-5983EPSS 1.0%

    Cross-site request forgery (CSRF) vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  8. 8.8CVE-2019-5980EPSS 1.0%

    Cross-site request forgery (CSRF) vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  9. 8.8CVE-2019-5979EPSS 1.0%

    Cross-site request forgery (CSRF) vulnerability in Personalized WooCommerce Cart Page 2.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  10. 8.8CVE-2019-5974EPSS 1.0%

    Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  11. 8.8CVE-2019-5973EPSS 1.1%

    Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  12. 8.8CVE-2019-5971EPSS 1.0%

    Cross-site request forgery (CSRF) vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  13. 8.8CVE-2019-5968EPSS 0.7%

    Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administrators via updating user's 'Basic Info'.

  14. 8.8CVE-2019-5963EPSS 1.0%

    Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  15. 8.8CVE-2019-5960EPSS 0.6%

    Cross-site request forgery (CSRF) vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  16. 8.4CVE-2019-6636EPSS 0.9%

    On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code e…

  17. 8.8CVE-2019-12851EPSS 0.8%

    A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.

  18. 8.8CVE-2019-5630EPSS 0.9%

    A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent …

  19. 8.8CVE-2018-10986EPSS 0.5%

    OX Guard 2.8.0 has CSRF.

  20. 8.8CVE-2018-11427EPSS 0.6%

    CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possible to perform CSRF attacks on the device administrator.

  21. 8.8CVE-2017-8406EPSS 1.2%

    An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and…

  22. 8.8CVE-2017-8407EPSS 1.2%

    An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request…

  23. 8.8CVE-2019-7262ExploitEPSS 16%

    Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).

  24. 8.8CVE-2019-7270EPSS 1.1%

    Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).

  25. 8.8CVE-2019-13056EPSS 0.8%

    An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of CSRF protection.

  26. 8.8CVE-2019-7273ExploitEPSS 4.5%

    Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF).

  27. 8.8CVE-2019-7281EPSS 0.9%

    Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious webs…

  28. 8.8CVE-2019-12826EPSS 1.1%

    A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to…

  29. 8.8CVE-2018-20848EPSS 0.8%

    Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] parameter to the latter.

  30. 6.5CVE-2019-5814EPSS 0.9%

    Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

  31. 8.8CVE-2019-6166EPSS 0.5%

    A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery.

  32. 8.8CVE-2018-1858EPSS 0.9%

    IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256.

  33. 8.8CVE-2019-9958EPSS 0.8%

    CSRF within the admin panel in Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to escalate privileges, or create new admin accounts by crafting a malicious web page that issues specific requests, using a target admin…

  34. 8.8CVE-2019-12836EPSS 1.0%

    The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a request to an out-of-origin domain. This in turn may allow for a forged request that can be invoked i…

  35. 8.8CVE-2019-1904EPSS 1.0%

    A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSR…

  36. 8.8CVE-2019-1874EPSS 0.8%

    A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is…

  37. 8.0CVE-2019-1632EPSS 0.5%

    A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an a…

  38. 8.8CVE-2018-17387EPSS 0.9%

    CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account.

  39. 8.8CVE-2018-17389EPSS 0.9%

    CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account.

  40. 8.0CVE-2017-8334EPSS 0.9%

    An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking IP addresses using the web management interface. It seems that the device does n…

  41. 8.8CVE-2017-8328EPSS 1.4%

    An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the …

  42. 8.8CVE-2018-18802EPSS 0.9%

    The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod_users/controller.php?action=edit.

  43. 8.8CVE-2019-4142EPSS 0.5%

    IBM Cloud Private 2.1.0, 3.1.0, 3.1.1, and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 15833…

  44. 8.8CVE-2017-9381EPSS 1.1%

    An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on the device using the web management interface. It seems that the device does not…

  45. 8.8CVE-2019-6325EPSS 1.0%

    HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery.

  46. 6.5CVE-2019-0996EPSS 1.6%

    A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. An attacker who successfully exploited this vulnerability could bypass OAuth p…

  47. 8.8CVE-2019-3410EPSS 0.5%

    All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trus…

  48. 8.8CVE-2019-10338EPSS 1.0%

    A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially le…

  49. 4.3CVE-2019-10331EPSS 1.1%

    A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to an attacker-specified URL using attacker-specified credentials.

  50. 6.5CVE-2019-11517EPSS 0.4%

    WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker could add/delete any vhosts without the consent of the owner.