cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 168

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2018-6009EPSS 0.6%

    In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

  2. 6.5CVE-2017-18033EPSS 0.5%

    The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various Cross-site request forgery (CSRF) vulnerabilities.

  3. 8.8CVE-2018-0107EPSS 0.8%

    A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) …

  4. 8.8CVE-2018-5329EPSS 0.5%

    ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) on /CWEBNET/* authenticated pages. A successful CSRF attack can force the user to modify state: creating users, changing an email address, and so fo…

  5. 8.8CVE-2018-5673EPSS 0.8%

    An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.

  6. 8.8CVE-2018-5669EPSS 0.6%

    An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php.

  7. 8.8CVE-2018-5658EPSS 0.6%

    An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php.

  8. 8.8CVE-2018-5656EPSS 0.6%

    An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php.

  9. 8.8CVE-2017-16886ExploitEPSS 7.1%

    The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access to Web Services via CSRF can result in an unauthorized change of username or pass…

  10. 8.8CVE-2016-0335EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote attackers to hijack the authentication of users for requests that h…

  11. 4.3CVE-2017-16862EPSS 0.6%

    The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability.

  12. 8.8CVE-2018-5368EPSS 0.6%

    The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php.

  13. 8.8CVE-2018-5361EPSS 1.0%

    The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.

  14. 8.8CVE-2012-0699ExploitEPSS 3.6%

    Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to fami…

  15. 6.5CVE-2018-0785EPSS 3.0%

    ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability".

  16. 6.5CVE-2018-5301EPSS 0.4%

    Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.

  17. 8.8CVE-2018-5285EPSS 0.7%

    The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.

  18. 8.8CVE-2017-1672EPSS 0.6%

    IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 133639.

  19. 6.8CVE-2018-5073EPSS 0.4%

    Online Ticket Booking has CSRF via admin/movieedit.php.

  20. 8.8CVE-2017-1000479ExploitEPSS 32%

    pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed i…

  21. 8.8CVE-2017-1000499ExploitEPSS 8.5%

    phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables…

  22. 8.0CVE-2017-1000432ExploitEPSS 1.6%

    Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access

  23. 8.8CVE-2017-17990EPSS 0.5%

    Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.

  24. 6.8CVE-2017-17982EPSS 0.4%

    PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.

  25. 8.8CVE-2014-0120EPSS 1.2%

    Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdo…

  26. 8.8CVE-2017-17960EPSS 0.5%

    PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.

  27. 8.8CVE-2017-17939EPSS 0.5%

    PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.

  28. 8.8CVE-2017-17936EPSS 0.5%

    Vanguard Marketplace Digital Products PHP has CSRF via /search.

  29. 8.8CVE-2017-17930EPSS 0.5%

    PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.

  30. 8.8CVE-2017-17908EPSS 0.5%

    PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.

  31. 8.8CVE-2017-17905EPSS 0.5%

    PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.

  32. 8.8CVE-2017-17903EPSS 0.5%

    FS Lynda Clone has CSRF via user/edit_profile, as demonstrated by adding content to the user panel.

  33. 8.8CVE-2017-17894EPSS 0.5%

    Readymade Job Site Script has CSRF via the /job URI.

  34. 8.8CVE-2017-17891EPSS 0.5%

    Readymade Video Sharing Script has CSRF via user-profile-edit.php.

  35. 6.8CVE-2017-17830EPSS 0.4%

    Bus Booking Script has CSRF via admin/new_master.php.

  36. 8.8CVE-2017-17827EPSS 0.8%

    Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions.

  37. 8.0CVE-2017-5263EPSS 0.3%

    Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application fu…

  38. 8.8CVE-2017-1746EPSS 0.5%

    IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Fo…

  39. 8.8CVE-2017-1631EPSS 0.5%

    IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Fo…

  40. 8.8CVE-2017-17774EPSS 0.6%

    admin/configuration.php in Piwigo 2.9.2 has CSRF.

  41. 8.8CVE-2017-14092EPSS 0.9%

    The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.

  42. 8.8CVE-2017-5264ExploitEPSS 2.7%

    Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.

  43. 7.3CVE-2017-14362EPSS 0.5%

    Cross-Site Request Forgery vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a Cross-Site Forgery attack.

  44. 8.8CVE-2017-17056EPSS 0.7%

    The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function of the Modify Password component, reachable via the old_password, new_password1, and new_pa…

  45. 8.8CVE-2017-12631EPSS 1.6%

    Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions…

  46. 8.8CVE-2016-10701EPSS 0.8%

    In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application.

  47. 8.8CVE-2017-8138EPSS 0.4%

    HedEx Earlier than V200R006C00 versions has a cross-site request forgery (CSRF) vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal s…

  48. 7.5CVE-2017-4928EPSS 1.2%

    The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these i…

  49. 6.5CVE-2017-1000224EPSS 0.5%

    CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin

  50. 8.8CVE-2017-15516EPSS 0.6%

    NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used to cause an unintended authenticated action in the user interface.