Fallos del tipo CWE-352

6074 resultados

Falsificação de Requisição Entre Sites (CSRF)

A aplicação não valida se uma requisição legítima foi realmente iniciada pelo usuário autenticado, permitindo que um atacante force ações em nome da vítima. Um invasor engana o navegador do usuário a enviar requisições maliciosas para um site onde a vítima está logada, explorando a confiança automática do navegador.

Ejemplo

Um usuário logado em seu banco recebe um email com um link que, ao clicar, faz uma requisição invisível para transferir dinheiro. Como o navegador envia automaticamente os cookies de sessão do banco, a transferência é processada sem confirmação adicional do usuário.

Cómo mitigar

Implemente tokens CSRF únicos por sessão (validados em cada requisição POST/PUT/DELETE), use o padrão SameSite nos cookies, e exija confirmação do usuário para ações críticas. Frameworks modernos como Laravel, Django e Express têm proteção nativa — ative por padrão.

CVE-2023-41697MEDIUMWordPress Easy WP Cleaner Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2022-38063MEDIUMWordPress Social Login WP Plugin <= 5.0.0.0 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-41850MEDIUMWordPress Outbound Link Manager Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-22674MEDIUMWordPress Dashicons + Custom Post Types Plugin <= 1.0.2 is vulnerable to Broken Access ControlEPSS 0.3%CVE-2023-6326MEDIUMMaster Slider - Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_actionEPSS 0.3%CVE-2023-25065MEDIUMWordPress WP Tabs Plugin <= 2.1.14 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-41851MEDIUMWordPress WP Custom Post Template Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-38390MEDIUMWordPress Mobile Address Bar Changer Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-5988MEDIUMAap-gateway: csrf origin checking is disabledEPSS 0.3%CVE-2023-5902MEDIUMCross-Site Request Forgery (CSRF) in pkp/pkp-libEPSS 0.3%CVE-2024-29338LOWAnchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.EPSS 0.3%CVE-2023-49843MEDIUMWordPress First Order Discount Woocommerce Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2026-12746HIGHDancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameterEPSS 0.3%CVE-2026-57290MEDIUMA cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwEPSS 0.3%CVE-2023-47824MEDIUMWordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-46614MEDIUMWordPress WP Helper Premium Plugin <= 4.5.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-6137MEDIUMWordPress Frontier Post Plugin <= 6.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2026-88418HIGHCMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin requesEPSS 0.3%CVE-2023-46636MEDIUMWordPress Custom Header Images Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2021-45785MEDIUMTruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to reEPSS 0.3%