VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (5,713)

page 33 of 286
  • CVE-2015-4089HigSep 19, 2017
    Wpfastestcache
    Wp Fastest Cache
    risk 0.57cvss 8.8epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1)…

  • CVE-2014-6106HigSep 18, 2017
    IBM
    Security Identity Manager
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that can cause cross-site scripting attacks, web cache poisoning, or other unspecified impacts via…

  • CVE-2016-8737HigSep 13, 2017
    Apache
    Brooklyn
    risk 0.57cvss 8.8epss 0.01

    In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as…

  • CVE-2017-11350HigSep 13, 2017
    Axesstel
    MU553S
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices.

  • CVE-2017-14267HigSep 11, 2017
    Ee
    4gee WiFi Mbb Firmware
    risk 0.57cvss 8.8epss 0.01

    EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings.

  • CVE-2015-4697HigSep 7, 2017
    WordPress
    Google Analyticator
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.

  • CVE-2014-9565HigSep 7, 2017
    IBM
    Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000 and earlier.

  • CVE-2017-12838HigSep 7, 2017
    Nexusphp Project
    Nexusphp
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via unspecified vectors.

  • CVE-2017-1097HigSep 5, 2017
    IBM
    Emptoris Strategic Supply Management
    risk 0.57cvss 8.8epss 0.01

    IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 120657.

  • CVE-2017-14048HigAug 31, 2017
    Blackcat CMS
    Blackcat CMS
    risk 0.57cvss 8.8epss 0.01

    BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF.

  • CVE-2017-1442HigAug 30, 2017
    IBM
    Emptoris Services Procurement
    risk 0.57cvss 8.8epss 0.01

    IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107.

  • CVE-2017-11455HigAug 29, 2017
    Ivanti
    Connect Secure
    risk 0.57cvss 8.8epss 0.01

    diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to…

  • CVE-2015-3655HigAug 29, 2017
    Arubanetworks
    Clearpass
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.

  • CVE-2014-8900HigAug 28, 2017
    IBM
    UrbanCode Release
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier.

  • CVE-2017-7926HigAug 25, 2017
    Osisoft
    Pi Webapi
    risk 0.57cvss 8.8epss 0.01

    A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0). The vulnerability allows cross-site request forgery (CSRF) attacks to occur when an otherwise-unauthorized cross-site request is sent from a browser the server has previously…

  • CVE-2017-12703HigAug 25, 2017
    Westermo
    MRD-315
    risk 0.57cvss 8.8epss 0.01

    A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible…

  • CVE-2015-5258HigAug 22, 2017
    Fedoraproject
    Fedora
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3.

  • CVE-2017-7557HigAug 22, 2017
    PowerDNS
    Dnsdist
    risk 0.57cvss 8.8epss 0.01

    dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.

  • CVE-2017-7423HigAug 21, 2017
    Microfocus
    Enterprise Developer
    risk 0.57cvss 8.8epss 0.01

    A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is…

  • CVE-2017-5187HigAug 21, 2017
    Microfocus
    Directory Server
    risk 0.57cvss 8.8epss 0.01

    A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote…