cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 161

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2018-12364EPSS 1.8%

    NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forger…

  2. 6.5CVE-2018-15438EPSS 1.2%

    A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected…

  3. 8.8CVE-2018-15402EPSS 0.5%

    A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers…

  4. 8.8CVE-2018-18436EPSS 0.5%

    JTBC(PHP) 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI.

  5. 8.8CVE-2018-18432EPSS 0.5%

    An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request.

  6. 8.8CVE-2018-18422EPSS 0.5%

    UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/a_adminx.php?x=a URI.

  7. 8.8CVE-2018-15539EPSS 0.6%

    Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.

  8. 8.8CVE-2018-18317EPSS 0.5%

    DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI.

  9. 8.8CVE-2018-18316EPSS 0.5%

    emlog v6.0.0 has CSRF via the admin/user.php?action=new URI.

  10. 8.8CVE-2018-18215EPSS 0.5%

    In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account.

  11. 8.8CVE-2018-12456EPSS 0.9%

    Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activat…

  12. 7.3CVE-2018-13800EPSS 0.6%

    A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions < V4.2.3). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious lin…

  13. 8.8CVE-2018-18201EPSS 0.5%

    qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.

  14. 8.8CVE-2018-17858EPSS 1.0%

    An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend.

  15. 8.8CVE-2018-18191EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password.

  16. 6.5CVE-2018-2474EPSS 0.7%

    SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.

  17. 6.5CVE-2018-15401EPSS 0.5%

    A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions o…

  18. 8.8CVE-2018-0451EPSS 0.7%

    A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The…

  19. 8.8CVE-2018-0446EPSS 0.6%

    A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected d…

  20. 8.8CVE-2018-0445EPSS 0.6%

    A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a CSRF attack and perform arbitrary actions on an affected device. The vulnerabili…

  21. 6.1CVE-2018-0444EPSS 0.4%

    A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a stored XSS attack against a user of the interface. The vulnerability is due to i…

  22. 8.8CVE-2018-0439EPSS 1.2%

    A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vu…

  23. 8.8CVE-2018-17986EPSS 0.6%

    rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.

  24. 8.8CVE-2018-5921EPSS 0.7%

    A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. This vulnerability is known as Cross Site Request Forgery, and could potentially be exploited remotely …

  25. 8.8CVE-2018-17869EPSS 0.5%

    DASAN H660GW devices do not implement any CSRF protection mechanism.

  26. 8.8CVE-2018-15702EPSS 0.5%

    The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field.

  27. 8.8CVE-2018-17826EPSS 0.5%

    HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default …

  28. 4.3CVE-2018-17081EPSS 0.6%

    e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page.

  29. 6.5CVE-2017-15608EPSS 0.4%

    Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings.

  30. 8.8CVE-2018-8844EPSS 0.9%

    Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the reque…

  31. 8.8CVE-2018-17366EPSS 0.6%

    An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.

  32. 8.8CVE-2018-15612EPSS 0.4%

    A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all version…

  33. 8.8CVE-2018-6504EPSS 0.6%

    A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF).

  34. 6.5CVE-2018-13398EPSS 0.5%

    The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.

  35. 8.8CVE-2018-16952EPSS 0.7%

    The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal user's password). NOTE: this CVE is ass…

  36. 8.8CVE-2018-17104EPSS 0.8%

    An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user.

  37. 8.8CVE-2018-17103EPSS 0.7%

    An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter

  38. 8.8CVE-2018-17102EPSS 0.7%

    An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.

  39. 6.5CVE-2018-17070EPSS 0.5%

    An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay.

  40. 6.5CVE-2018-17069EPSS 0.5%

    An issue was discovered in UNL-CMS 7.59. A CSRF attack can create new content via ?q=node%2Fadd%2Farticle&render=overlay&render=overlay.

  41. 8.8CVE-2018-17045EPSS 0.5%

    An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksi_users.php?act=update.

  42. 8.8CVE-2018-17023EPSS 0.6%

    Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password vi…

  43. 8.0CVE-2018-16951EPSS 0.8%

    xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832.

  44. 6.5CVE-2018-16832EPSS 0.6%

    CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header.

  45. 6.5CVE-2016-7067EPSS 0.9%

    Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host or disable/enable monitoring for a specific service.

  46. 8.8CVE-2018-16732EPSS 0.5%

    \upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.

  47. 8.8CVE-2018-0647EPSS 0.6%

    Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  48. 8.8CVE-2018-16650EPSS 0.5%

    phpMyFAQ before 2.9.11 allows CSRF.

  49. 8.8CVE-2018-1000669EPSS 0.5%

    KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountou…

  50. 8.8CVE-2018-16552EPSS 0.6%

    MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.