cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 158

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2019-6282ExploitEPSS 3.0%

    ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password.

  2. 8.8CVE-2018-20648EPSS 0.6%

    PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.

  3. 8.8CVE-2018-20644EPSS 0.7%

    PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.

  4. 8.8CVE-2018-20641EPSS 0.6%

    PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.

  5. 8.8CVE-2018-20633EPSS 0.7%

    PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.

  6. 6.1CVE-2018-19525EPSS 0.9%

    An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave with resultant XSS because of a lack of csrf token validati…

  7. 6.5CVE-2018-19511EPSS 0.7%

    wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password.

  8. 6.5CVE-2018-17996ExploitEPSS 3.0%

    LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.

  9. 8.8CVE-2018-14575ExploitEPSS 2.4%

    Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject.

  10. 8.8CVE-2019-9787EPSS 39%

    WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimizatio…

  11. 8.8CVE-2019-9769ExploitEPSS 2.3%

    PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator.

  12. 8.8CVE-2019-5924EPSS 1.2%

    Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.

  13. 8.8CVE-2019-5920EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.

  14. 8.8CVE-2019-9688EPSS 0.7%

    sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=add_post CSRF to add an admin account.

  15. 8.8CVE-2019-9652EPSS 0.6%

    There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the t2 parameter.

  16. 6.5CVE-2019-9598EPSS 0.5%

    An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds.

  17. 8.8CVE-2019-8437EPSS 0.7%

    njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator.

  18. 8.8CVE-2019-6710ExploitEPSS 3.0%

    Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.

  19. 8.8CVE-2018-18449EPSS 0.7%

    EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.

  20. 8.8CVE-2018-17429EPSS 0.6%

    /console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account.

  21. 8.8CVE-2019-9625ExploitEPSS 2.4%

    JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account.

  22. 6.5CVE-2019-9603EPSS 0.5%

    MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.

  23. 8.8CVE-2019-6561EPSS 1.2%

    Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.

  24. 8.8CVE-2019-9549EPSS 0.7%

    An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935.

  25. 8.8CVE-2019-9182EPSS 0.8%

    There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the filetext parameter.

  26. 8.0CVE-2019-9062EPSS 0.5%

    PHP Scripts Mall Online Food Ordering Script 1.0 has Cross-Site Request Forgery (CSRF) in my-account.php.

  27. 6.5CVE-2019-9052EPSS 0.6%

    An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI.

  28. 6.5CVE-2019-9051EPSS 0.6%

    An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI.

  29. 6.5CVE-2019-9049EPSS 0.6%

    An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=module_delete&var1= URI.

  30. 6.5CVE-2019-9048EPSS 0.6%

    An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme (aka topic) via a /admin.php?action=theme_delete&var1= URI.

  31. 8.8CVE-2019-9040EPSS 0.6%

    S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332.

  32. 8.8CVE-2019-8910EPSS 0.6%

    An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=site_post CSRF.

  33. 5.7CVE-2019-8902EPSS 0.4%

    An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI.

  34. 8.8CVE-2019-0267EPSS 0.7%

    SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an extern…

  35. 8.8CVE-2019-8347EPSS 0.7%

    BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP accounts via the admin/admin_member.php?action=add&nav=add_web_user&admin_p_nav=user URI.

  36. 6.5CVE-2019-7738EPSS 0.6%

    C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI.

  37. 8.8CVE-2019-7737EPSS 0.7%

    A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit.

  38. 5.7CVE-2019-7730EPSS 0.4%

    MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnerability for deleting a database via the /?q=wrkfrm&type=databases URI.

  39. 8.8CVE-2018-20780EPSS 0.8%

    Traq 3.7.1 allows admin/users/new CSRF to create an admin account (aka group_id=1).

  40. 6.5CVE-2019-7570EPSS 0.5%

    A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI.

  41. 8.8CVE-2019-7569EPSS 0.7%

    An issue was discovered in DOYO (aka doyocms) 2.3(20140425 update). There is a CSRF vulnerability that can add a super administrator account via admin.php?c=a_adminuser&a=add&run=1.

  42. 8.8CVE-2019-7566EPSS 0.7%

    CSZ CMS 1.1.8 has CSRF via admin/users/new/add.

  43. 6.5CVE-2019-1003022EPSS 0.7%

    A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master.

  44. 5.3CVE-2019-1003017EPSS 0.5%

    A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessa…

  45. 8.8CVE-2019-1003016EPSS 0.9%

    An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalCo…

  46. 6.5CVE-2019-1003012EPSS 1.1%

    A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlc…

  47. 4.3CVE-2019-1003010EPSS 1.1%

    A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a…

  48. 8.8CVE-2019-1003008EPSS 1.2%

    A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code v…

  49. 8.8CVE-2019-1003007EPSS 1.2%

    A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.

  50. 6.1CVE-2019-7402EPSS 0.4%

    An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can be exploited via CSRF.