cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 85

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2024-0858EPSS 0.4%

    The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.

  2. 8.8CVE-2024-0779EPSS 0.4%

    The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagr…

  3. 6.3CVE-2024-27974EPSS 0.2%

    Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, t…

  4. 6.1CVE-2024-22475EPSS 0.3%

    Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. allows a remote unauthenticated attacker to perform unintended operations on the affected …

  5. 4.3CVE-2024-2560EPSS 0.4%

    A vulnerability classified as problematic was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery…

  6. 6.5CVE-2024-2559EPSS 0.3%

    A vulnerability classified as problematic has been found in Tenda AC18 15.03.05.05. Affected is the function fromSysToolReboot of the file /goform/SysToolReboot. The manipulation leads to cross-site request forgery. It is possible to launc…

  7. 7.1CVE-2024-27197EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in Bee BeePress allows Stored XSS.This issue affects BeePress: from n/a through 6.9.8.

  8. 7.1CVE-2024-27195EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in sverde1 Watermark RELOADED watermark-reloaded allows Cross Site Request Forgery.This issue affects Watermark RELOADED: from n/a through <= 1.3.5.

  9. 6.1CVE-2024-27194EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in Andrei Ivasiuc Fontific | Google Fonts allows Stored XSS.This issue affects Fontific | Google Fonts: from n/a through 0.1.6.

  10. 8.8CVE-2023-51487EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft ARI Stream Quiz.This issue affects ARI Stream Quiz: from n/a through 1.2.32.

  11. 8.8CVE-2023-51486EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.

  12. 8.8CVE-2023-51474EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelemu TerraClassifieds.This issue affects TerraClassifieds: from n/a through 2.0.3.

  13. 5.4CVE-2023-51521EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.

  14. 8.8CVE-2023-51512EPSS 0.2%

    Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.This issue affects Product Table by WBW: from n/a through 1.8.6.

  15. 8.8CVE-2023-51510EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0.

  16. 8.8CVE-2023-51491EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6.

  17. 8.8CVE-2023-51489EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.

  18. 8.8CVE-2023-51407EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9.

  19. 8.8CVE-2023-51522EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4.

  20. 8.8CVE-2023-51369EPSS 0.3%

    Cross-Site Request Forgery (CSRF) vulnerability in SysBasics Customize My Account for WooCommerce.This issue affects Customize My Account for WooCommerce: from n/a through 1.8.3.

  21. 8.0CVE-2023-50886EPSS 0.2%

    Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.

  22. 4.3CVE-2023-51525EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a through 2.0.8.4.

  23. 8.8CVE-2023-50861EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.

  24. 4.3CVE-2024-2483EPSS 0.3%

    A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects some unknown processing of the file /change-password.php of the component Password Change Handler. Th…

  25. 6.5CVE-2024-27265EPSS 0.2%

    IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 2…

  26. 8.8CVE-2024-28195EPSS 0.4%

    your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery (CSRF). Attackers can use this to execute CSRF attacks on victims…

  27. 6.3CVE-2024-28682EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php.

  28. 6.1CVE-2024-28681EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php.

  29. 6.3CVE-2024-28678EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_description_main.php

  30. 6.1CVE-2024-28677EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php.

  31. 8.8CVE-2024-28673EPSS 0.4%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php.

  32. 5.4CVE-2024-28672EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php.

  33. 6.1CVE-2024-28670EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_main.php.

  34. 5.4CVE-2024-28669EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php.

  35. 4.3CVE-2024-1642EPSS 0.3%

    The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validatio…

  36. 4.3CVE-2024-1489EPSS 0.2%

    The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction fun…

  37. 4.3CVE-2024-0830EPSS 0.3%

    The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This…

  38. 4.3CVE-2024-0827EPSS 0.2%

    The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.4. This is due to missing or incorrect nonce validation on s…

  39. 5.4CVE-2024-0592EPSS 0.3%

    The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the handle_create_link() function. This m…

  40. 8.8CVE-2024-28684EPSS 0.3%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php

  41. 8.8CVE-2024-28675EPSS 0.3%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php

  42. 6.1CVE-2024-28667EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/templets_one_edit.php

  43. 5.5CVE-2024-28666EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media_add.php

  44. 8.8CVE-2024-28665EPSS 0.3%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.php

  45. 8.8CVE-2024-28432EPSS 0.3%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.

  46. 8.8CVE-2024-28431EPSS 0.3%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php.

  47. 6.1CVE-2024-28430EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php.

  48. 5.5CVE-2024-28429EPSS 0.2%

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php

  49. 6.5CVE-2024-2416EPSS 0.2%

    Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application in which they are curre…

  50. 4.3CVE-2015-10130EPSS 0.2%

    The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail_slider_with_lightbox_image_management_…