cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 162

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2018-15682EPSS 0.5%

    An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically s…

  2. 6.1CVE-2018-15677EPSS 0.5%

    The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.

  3. 8.8CVE-2018-14769EPSS 0.5%

    VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.

  4. 6.5CVE-2018-16458EPSS 0.4%

    An issue was discovered in baigo CMS v2.1.1. There is an index.php?m=article&c=request CSRF that can cause publication of any article.

  5. 6.5CVE-2018-16449EPSS 0.6%

    OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html.

  6. 8.8CVE-2018-16448EPSS 0.5%

    Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin…

  7. 8.8CVE-2018-16447EPSS 0.7%

    Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF.

  8. 8.8CVE-2018-16431EPSS 0.8%

    admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account.

  9. 8.8CVE-2018-16416EPSS 0.9%

    Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.

  10. 8.8CVE-2018-16387EPSS 0.7%

    An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add.

  11. 8.8CVE-2018-16380EPSS 0.6%

    An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account.

  12. 8.8CVE-2018-16366EPSS 0.6%

    An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF.

  13. 8.8CVE-2018-16365EPSS 0.6%

    An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF.

  14. 8.8CVE-2018-16345EPSS 0.5%

    An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent.

  15. 8.8CVE-2018-16339EPSS 0.5%

    An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser.

  16. 8.8CVE-2018-16338EPSS 0.5%

    An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic.

  17. 6.5CVE-2018-16337EPSS 0.4%

    An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save.

  18. 8.8CVE-2018-16332EPSS 0.6%

    An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability.

  19. 8.8CVE-2018-16331EPSS 0.5%

    admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.

  20. 6.5CVE-2018-16315EPSS 0.4%

    In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.

  21. 8.8CVE-2018-16314EPSS 0.7%

    An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.

  22. 8.8CVE-2018-11718EPSS 0.5%

    Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF.

  23. 8.8CVE-2018-15121EPSS 0.5%

    An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during aut…

  24. 8.8CVE-2018-15901EPSS 0.6%

    e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.

  25. 8.8CVE-2018-15884ExploitEPSS 2.5%

    RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.

  26. 8.8CVE-2014-6046ExploitEPSS 1.9%

    Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CS…

  27. 8.8CVE-2018-15851EPSS 0.6%

    An issue was discovered in Flexo CMS v0.1.6. There is a CSRF vulnerability that can add an administrator via /admin/user/add.

  28. 8.8CVE-2018-15850EPSS 0.6%

    An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user.

  29. 4.3CVE-2018-15849EPSS 0.4%

    An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php.

  30. 8.8CVE-2018-15848EPSS 0.5%

    An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true.

  31. 8.8CVE-2018-15846EPSS 0.7%

    An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1.

  32. 8.8CVE-2018-15845ExploitEPSS 2.3%

    There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.

  33. 8.8CVE-2018-15844ExploitEPSS 2.4%

    An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit.

  34. 6.5CVE-2018-11502ExploitEPSS 1.9%

    An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker can remotely delete all mod notes and mod note logs in the modCP and ACP via CS…

  35. 8.8CVE-2018-10884EPSS 0.9%

    Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijack…

  36. 6.5CVE-2018-15569EPSS 0.4%

    my little forum 2.4.12 allows CSRF for deletion of users.

  37. 8.8CVE-2018-15568EPSS 0.5%

    tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html.

  38. 8.8CVE-2018-15565EPSS 0.6%

    An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF.

  39. 8.8CVE-2018-15564EPSS 0.5%

    An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8.

  40. 8.8CVE-2018-14057ExploitEPSS 3.3%

    Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.

  41. 9.9CVE-2018-1712EPSS 0.7%

    IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted …

  42. 8.8CVE-2018-1455EPSS 0.8%

    IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM …

  43. 6.5CVE-2018-13394EPSS 0.8%

    The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote attackers to modify a comment into an a…

  44. 6.5CVE-2018-13393EPSS 0.8%

    The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote attackers to modify a comment…

  45. 8.8CVE-2018-2442EPSS 0.7%

    In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user se…

  46. 8.8CVE-2018-7097EPSS 0.7%

    A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow cross-site request forgery.

  47. 8.8CVE-2018-14783EPSS 0.7%

    NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. A cross-site request forgery condition can occur, allowing an attacker to change passwords of the device remotely.

  48. 8.0CVE-2018-15187EPSS 0.5%

    PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.

  49. 8.8CVE-2018-15186EPSS 0.5%

    PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php.

  50. 6.5CVE-2018-15203EPSS 0.4%

    An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/add_page allows a CSRF attack to add pages.