cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 165

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2018-11371EPSS 0.6%

    SkyCaiji 1.2 allows CSRF to add an Administrator user.

  2. 6.5CVE-2018-11096EPSS 0.5%

    Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely.

  3. 6.5CVE-2018-11092EPSS 0.9%

    An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.

  4. 8.8CVE-2018-1434EPSS 0.9%

    IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site request forgery w…

  5. 8.8CVE-2018-0270EPSS 0.7%

    A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and alter the data of existing users …

  6. 5.4CVE-2017-2613EPSS 1.6%

    jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large numbe…

  7. 6.5CVE-2018-11127EPSS 0.5%

    e107 2.1.7 has CSRF resulting in arbitrary user deletion.

  8. 8.8CVE-2018-11126EPSS 0.6%

    dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account.

  9. 8.8CVE-2017-12126EPSS 1.0%

    An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP packet can cause cross-site request forgery. An attacker can create malicious HTML…

  10. 8.8CVE-2018-11018EPSS 0.6%

    An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html.

  11. 8.8CVE-2018-11004EPSS 0.6%

    An issue was discovered in SDcms v1.5. Cross-site request forgery (CSRF) vulnerability in /WWW//app/admin/controller/admincontroller.php allows remote attackers to add administrator accounts via m=admin&c=admin&a=add.

  12. 6.5CVE-2018-11003EPSS 0.7%

    An issue was discovered in YXcms 1.4.7. Cross-site request forgery (CSRF) vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel.

  13. 8.8CVE-2018-6458EPSS 9.8%

    Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.

  14. 8.8CVE-2018-6023ExploitEPSS 2.3%

    Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi activating, etc.

  15. 6.1CVE-2018-10803EPSS 0.7%

    Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted descripti…

  16. 8.8CVE-2018-10957EPSS 0.8%

    CSRF exists on D-Link DIR-868L devices, leading to (for example) a change to the Admin password. hedwig.cgi and pigwidgeon.cgi are two of the affected components.

  17. 5.4CVE-2018-10806EPSS 0.3%

    An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. This can be used in conjunction with CSRF.

  18. 6.5CVE-2018-10758EPSS 0.5%

    The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles.

  19. 8.8CVE-2018-10166EPSS 0.7%

    The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authent…

  20. 8.8CVE-2013-0185EPSS 0.7%

    Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.

  21. 5.4CVE-2018-10554EPSS 2.6%

    An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime…

  22. 8.8CVE-2018-10503EPSS 0.5%

    An issue was discovered in index.php in baijiacms V4 v4_1_4_20170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser.

  23. 8.8CVE-2018-1479EPSS 0.7%

    IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 140761.

  24. 8.8CVE-2018-10312ExploitEPSS 2.3%

    index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.

  25. 8.8CVE-2018-10233EPSS 0.7%

    The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin.

  26. 8.8CVE-2018-10295EPSS 0.5%

    ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account.

  27. 8.8CVE-2018-10267EPSS 0.5%

    WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI.

  28. 8.8CVE-2018-10266EPSS 0.6%

    BEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user URI.

  29. 8.8CVE-2018-10265EPSS 0.4%

    An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI.

  30. 8.8CVE-2018-10249EPSS 0.5%

    baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account.

  31. 6.5CVE-2018-10248EPSS 0.5%

    An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycle_delete.

  32. 8.8CVE-2018-0259EPSS 0.7%

    A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vu…

  33. 8.8CVE-2018-0255EPSS 0.9%

    A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulne…

  34. 8.8CVE-2018-10188ExploitEPSS 4.1%

    phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.

  35. 6.8CVE-2018-10224EPSS 0.5%

    An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html.

  36. 6.8CVE-2018-10223EPSS 0.5%

    An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.html.

  37. 8.8CVE-2018-10222EPSS 0.6%

    An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=article_category&do=save&frame=iPHP.

  38. 8.8CVE-2018-10185EPSS 0.5%

    An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call.

  39. 8.8CVE-2018-10137EPSS 0.5%

    iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage_settings&action=edit URI.

  40. 8.8CVE-2018-10132EPSS 0.5%

    PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter.

  41. 8.8CVE-2018-10127EPSS 0.5%

    An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role.

  42. 8.8CVE-2018-10117EPSS 0.5%

    An issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an admin account via admincp.php?app=members&do=save&frame=iPHP.

  43. 8.8CVE-2017-0362EPSS 0.8%

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.

  44. 8.8CVE-2018-6934EPSS 0.5%

    CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.

  45. 8.8CVE-2015-0151EPSS 1.1%

    Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

  46. 8.8CVE-2018-10048EPSS 0.5%

    iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.

  47. 8.8CVE-2018-10031EPSS 0.5%

    CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.

  48. 8.8CVE-2018-10030EPSS 0.5%

    CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.

  49. 8.8CVE-2018-9927EPSS 0.7%

    An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add.

  50. 8.8CVE-2018-9926ExploitEPSS 2.9%

    An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add.