cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 160

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2018-19621EPSS 0.4%

    server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team.

  2. 8.8CVE-2018-14892EPSS 0.9%

    Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform state-changing actions via crafted HTTP forms.

  3. 8.8CVE-2018-16854EPSS 2.3%

    A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.…

  4. 8.8CVE-2018-19561EPSS 0.4%

    sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account.

  5. 8.8CVE-2018-19560EPSS 0.7%

    BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account.

  6. 8.8CVE-2018-19555EPSS 0.5%

    tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password.

  7. 8.8CVE-2018-19546EPSS 0.5%

    JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter.

  8. 8.8CVE-2018-19545EPSS 0.5%

    JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user.

  9. 6.5CVE-2018-19544EPSS 0.4%

    JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.

  10. 6.5CVE-2018-19376EPSS 0.5%

    An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clear URI.

  11. 8.8CVE-2018-18773ExploitEPSS 3.4%

    CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.

  12. 8.8CVE-2018-18772ExploitEPSS 3.5%

    CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.

  13. 5.3CVE-2018-19335EPSS 0.4%

    Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive …

  14. 5.3CVE-2018-19334EPSS 0.3%

    Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive info…

  15. 5.3CVE-2018-10099EPSS 0.3%

    Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive infor…

  16. 8.8CVE-2018-19332EPSS 0.5%

    An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI.

  17. 8.8CVE-2018-19327EPSS 0.5%

    An issue was discovered in JTBC(PHP) 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF.

  18. 6.5CVE-2018-19319EPSS 0.4%

    SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges.

  19. 8.8CVE-2018-19318EPSS 0.5%

    SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.

  20. 8.8CVE-2018-18799ExploitEPSS 2.4%

    School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.

  21. 8.8CVE-2018-18797ExploitEPSS 2.4%

    School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.

  22. 8.8CVE-2018-18794ExploitEPSS 2.4%

    School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.

  23. 6.5CVE-2018-18760ExploitEPSS 2.6%

    RhinOS 3.0 build 1190 allows CSRF.

  24. 6.5CVE-2018-19291EPSS 0.7%

    An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI.

  25. 8.8CVE-2018-12416EPSS 0.6%

    The GridServer Broker and GridServer Director components of TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an unauthenticated user to perform cross-site request forgery (CSRF). Affected r…

  26. 8.8CVE-2018-19225EPSS 0.5%

    An issue was discovered in LAOBANCMS 2.0. admin/mima.php has CSRF.

  27. 8.8CVE-2018-19192EPSS 0.5%

    An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the data[content] parameter.

  28. 8.8CVE-2018-19135ExploitEPSS 3.0%

    ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one ca…

  29. 8.8CVE-2017-17550EPSS 0.5%

    ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS.

  30. 8.8CVE-2018-19138ExploitEPSS 2.2%

    WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI.

  31. 8.0CVE-2018-15445EPSS 0.9%

    A vulnerability in the web-based management interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affecte…

  32. 8.8CVE-2018-19104EPSS 0.6%

    In BageCMS 3.1.3, upload/index.php has a CSRF vulnerability that can be used to upload arbitrary files and get server privileges.

  33. 8.8CVE-2018-12415EPSS 0.9%

    The Central Administration server (emsca) component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulner…

  34. 8.8CVE-2018-12414EPSS 0.7%

    The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.'s TIBCO Rendezvous, TIBCO R…

  35. 8.8CVE-2018-12413EPSS 0.9%

    The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterpr…

  36. 8.8CVE-2018-12412EPSS 0.9%

    The realm server (tibrealmserver) component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site …

  37. 8.8CVE-2018-12411EPSS 0.9%

    The administrative daemon (tibdgadmind) of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attack…

  38. 8.8CVE-2018-18935EPSS 0.6%

    An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account.

  39. 9.8CVE-2018-18934EPSS 0.8%

    An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code (that is extracted an…

  40. 8.8CVE-2018-6907EPSS 0.5%

    A Cross Site Request Forgery (CSRF) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attacker to control the RainMachine device via the REST API.

  41. 8.8CVE-2018-18842EPSS 0.8%

    CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code.

  42. 8.8CVE-2018-18742EPSS 0.5%

    A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI.

  43. 8.8CVE-2018-18735EPSS 0.5%

    A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33.

  44. 8.8CVE-2018-18734EPSS 0.5%

    A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30.

  45. 8.8CVE-2018-18712EPSS 0.7%

    An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1.

  46. 8.8CVE-2018-18711EPSS 0.7%

    An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.

  47. 8.8CVE-2018-9281EPSS 0.4%

    An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent…

  48. 8.8CVE-2018-18420EPSS 0.8%

    Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI.

  49. 8.0CVE-2015-4630ExploitEPSS 3.0%

    Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to (1) hijack the authentication of administrators for …

  50. 8.8CVE-2018-12370EPSS 1.1%

    In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a malicious site while Reader mode is active, bypassing CSRF protections. This vulnera…