cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 159

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2019-1000022EPSS 0.6%

    Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket handshake endpoint that can result in CSRF attack, possible leak of anti-CSRF token. This attack appears to be exploitab…

  2. 8.8CVE-2019-1000003EPSS 0.8%

    MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. T…

  3. 8.8CVE-2019-7346EPSS 0.7%

    A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the failed request, making the CSRF attack successful.

  4. 8.8CVE-2019-3604EPSS 0.4%

    Cross-Site Request Forgery (CSRF) vulnerability in McAfee ePO (legacy) Cloud allows unauthenticated users to perform unintended ePO actions using an authenticated user's session via unspecified vectors.

  5. 8.1CVE-2019-6779EPSS 0.5%

    Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.

  6. 7.4CVE-2019-1658EPSS 0.6%

    A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected d…

  7. 8.8CVE-2017-17835EPSS 2.0%

    In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.

  8. 8.8CVE-2019-6510EPSS 0.7%

    An issue was discovered in creditease-sec insight through 2018-09-11. user_delete in srcpm/app/admin/views.py allows CSRF.

  9. 8.8CVE-2019-6509EPSS 0.7%

    An issue was discovered in creditease-sec insight through 2018-09-11. depart_delete in srcpm/app/admin/views.py allows CSRF.

  10. 8.8CVE-2019-6508EPSS 0.7%

    An issue was discovered in creditease-sec insight through 2018-09-11. role_perm_delete in srcpm/app/admin/views.py allows CSRF.

  11. 8.8CVE-2019-6507EPSS 0.7%

    An issue was discovered in creditease-sec insight through 2018-09-11. login_user_delete in srcpm/app/admin/views.py allows CSRF.

  12. 8.8CVE-2018-20728EPSS 0.6%

    A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php.

  13. 8.8CVE-2016-10738EPSS 0.7%

    Zenbership v107 has CSRF via admin/cp-functions/event-add.php.

  14. 8.8CVE-2019-6294EPSS 0.5%

    An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI.

  15. 8.8CVE-2019-6249ExploitEPSS 3.0%

    An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/index.php?load=admins&act=edit_info&act_type=add.

  16. 8.8CVE-2019-6244EPSS 0.5%

    An issue was discovered in UsualToolCMS 8.0. cmsadmin/a_sqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and consequently execute arbitrary PHP code by writing that code into a .php file.

  17. 8.1CVE-2018-1000417EPSS 0.8%

    A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates.

  18. 8.1CVE-2018-1000414EPSS 0.8%

    A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.

  19. 6.5CVE-2018-1000411EPSS 0.8%

    A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

  20. 8.8CVE-2018-20613EPSS 0.5%

    TEMMOKU T1.09 Beta allows admin/user/add CSRF.

  21. 8.8CVE-2018-20612EPSS 0.5%

    UWA 2.3.11 allows index.php?g=admin&c=admin&a=add_admin_do CSRF.

  22. 8.8CVE-2018-20603EPSS 0.5%

    Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.

  23. 8.8CVE-2018-20598EPSS 0.5%

    UCMS 1.4.7 has ?do=user_addpost CSRF.

  24. 8.8CVE-2018-20595EPSS 0.6%

    A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is s…

  25. 9.1CVE-2018-20577EPSS 0.6%

    Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewall_SPI.exe, cgi-bin/setup_remote_mgmt.exe, cgi-bin/setup_pass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Mo…

  26. 5.4CVE-2018-20576EPSS 0.4%

    Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phone_test.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot…

  27. 8.8CVE-2018-18696EPSS 0.8%

    main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy.com/s/article/KB37643-New-security-feature…

  28. 4.3CVE-2018-15334EPSS 0.7%

    A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication.

  29. 8.8CVE-2018-19182EPSS 0.6%

    Engelsystem before commit hash 2e28336 allows CSRF.

  30. 8.8CVE-2018-20419EPSS 0.5%

    DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account.

  31. 6.5CVE-2018-8892EPSS 0.4%

    A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrat…

  32. 8.8CVE-2018-1000858EPSS 1.0%

    GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD…

  33. 8.8CVE-2018-1000846EPSS 0.6%

    FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This atta…

  34. 8.8CVE-2018-1000843EPSS 0.8%

    Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result i…

  35. 8.8CVE-2018-1661EPSS 0.9%

    IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 1448…

  36. 8.8CVE-2018-20231EPSS 1.4%

    Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.

  37. 8.0CVE-2018-20228EPSS 0.4%

    Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.

  38. 6.5CVE-2018-19829ExploitEPSS 1.9%

    Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.

  39. 6.5CVE-2018-18921EPSS 0.6%

    PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action.

  40. 8.8CVE-2018-20188EPSS 0.5%

    FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.

  41. 6.5CVE-2018-18246EPSS 0.5%

    Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module.

  42. 8.8CVE-2018-1926EPSS 1.2%

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could…

  43. 8.8CVE-2018-19969EPSS 1.1%

    phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables…

  44. 8.8CVE-2018-20015EPSS 0.5%

    YzmCMS v5.2 has admin/role/add.html CSRF.

  45. 8.8CVE-2018-19923EPSS 0.5%

    An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is member/member_email.php?action=edit CSRF.

  46. 7.5CVE-2018-19911EPSS 2.7%

    FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an ap…

  47. 8.8CVE-2018-1002103EPSS 0.7%

    In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Ku…

  48. 8.8CVE-2018-16634EPSS 0.5%

    Pluck v4.7.7 allows CSRF via admin.php?action=settings.

  49. 8.8CVE-2018-7831EPSS 0.6%

    An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted UR…

  50. 8.8CVE-2018-1927EPSS 0.7%

    IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153118.