VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (5,713)

page 239 of 286
  • CVE-2008-5621Dec 17, 2008
    PhpMyAdmin
    phpMyAdmin
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other…

  • CVE-2008-5568Dec 15, 2008
    Ipn Mate
    Ipn Pro 3
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the admin_id, newpass_1, and newpass_2 parameters.

  • CVE-2008-5567Dec 15, 2008
    Bonzacart
    Bonza Cart
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the NewAdmin, NewPass1, and NewPass2 parameters.

  • CVE-2008-5565Dec 15, 2008
    DL PayCart
    DL PayCart
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the NewAdmin, NewPass1, and NewPass2 parameters.

  • CVE-2008-5115Nov 18, 2008
    Sun Corporation
    Java System Identity Manager
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of administrators for requests that update the password via idm/admin/changeself.jsp.

  • CVE-2008-4247Sep 25, 2008
    FreeBSD
    FreeBSD
    risk 0.03cvss —epss 0.04

    ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via…

  • CVE-2008-3925Sep 4, 2008
    Content Management Made Easy
    CMME
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin.php in Content Management Made Easy (CMME) 1.12 allows remote attackers to trigger the logout of an administrative user via a logout action.

  • CVE-2008-3080Jul 9, 2008
    Mywebland
    Mybloggie
    risk 0.03cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to perform edit actions as administrators. NOTE: this can be leveraged to execute SQL commands by also exploiting CVE-2007-1899.

  • CVE-2008-2276May 16, 2008
    Mantisbt
    Mantis
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users via a crafted link.

  • CVE-2008-0266Jan 15, 2008
    Eticket
    Eticket
    risk 0.03cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative password and possibly perform other administrative tasks. NOTE: either the old password must be known, or the attacker must leverage a separate…

  • CVE-2007-6490Dec 20, 2007
    Falcon
    Series One CMS
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain changepass action to index.php.

  • CVE-2007-6087Nov 22, 2007
    Vigilecms
    Vigilecms
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index.php in VigileCMS 1.4 allows remote attackers to change the admin password via certain parameters to the changepass module.

  • CVE-2007-5918Nov 10, 2007
    Ms Topsites
    Ms Topsites
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an…

  • CVE-2007-5773Nov 1, 2007
    Flatnuke
    Flatnuke
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform certain actions as administrators via requests containing the pathname in the dir parameter and the filename in the ffile parameter.

  • CVE-2007-5229Oct 5, 2007
    Feedburner
    Feedsmith
    risk 0.03cvss —epss 0.05

    Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attackers to change settings and hijack blog feeds via a request to wp-admin/options-general.php that submits parameter values to FeedBurner_FeedSmith_Plugin.php,…

  • CVE-2007-5060Sep 24, 2007
    Xcms
    Xcms
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the cpass functionality in an admin action in index.php in XCMS allows remote attackers to change arbitrary passwords via certain password_ and rpassword_ parameters, possibly related to timestamp values.

  • CVE-2007-4930Sep 18, 2007
    Axis
    207w Network Camera
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 207W camera allow remote attackers to perform certain actions as administrators via (1) axis-cgi/admin/restart.cgi, (2) the user and sgrp parameters to axis-cgi/admin/pwdgrp.cgi in an add action, or (3) the…

  • CVE-2006-6741Dec 26, 2006
    Mkportal
    Mkportal
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a delete operation in an img BBcode tag.

  • CVE-2012-4431Dec 19, 2012
    Apache
    Tomcat
    risk 0.01cvss —epss 0.09

    org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

  • CVE-2008-4242Sep 25, 2008
    Proftpd
    Proftpd
    risk 0.01cvss —epss 0.07

    ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client…