CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

CWE-345

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (9,651)

page 31 of 483

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2023-49446	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
CVE-2023-49398	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.
CVE-2023-49397	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
CVE-2023-49396	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.
CVE-2023-49395	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.
CVE-2023-49383	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.
CVE-2023-49382	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.
CVE-2023-49381	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.
CVE-2023-49380	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.
CVE-2023-49379	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.
CVE-2023-49378	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.
CVE-2023-49377	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.
CVE-2023-49376	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.
CVE-2023-49375	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.
CVE-2023-49374	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
CVE-2023-49373	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.
CVE-2023-49372	JFinalcms JFinalcms	Hig	0.57	8.8	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
CVE-2023-24048	Connectize AC21000 G6	Hig	0.57	8.8	Dec 4, 2023	Cross Site Request Forgery (CSRF) vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /man_password.htm.
CVE-2023-48914	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	Nov 30, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.
CVE-2023-48913	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	Nov 30, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.

CVE-2023-49446HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
CVE-2023-49398HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.
CVE-2023-49397HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
CVE-2023-49396HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.
CVE-2023-49395HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.
CVE-2023-49383HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.
CVE-2023-49382HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.
CVE-2023-49381HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.
CVE-2023-49380HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.
CVE-2023-49379HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.
CVE-2023-49378HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.
CVE-2023-49377HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.
CVE-2023-49376HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.
CVE-2023-49375HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.
CVE-2023-49374HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
CVE-2023-49373HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.
CVE-2023-49372HigDec 5, 2023
JFinalcms
JFinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
CVE-2023-24048HigDec 4, 2023
Connectize
AC21000 G6
risk 0.57cvss 8.8epss 0.00
Cross Site Request Forgery (CSRF) vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /man_password.htm.
CVE-2023-48914HigNov 30, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.
CVE-2023-48913HigNov 30, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.