Fallos del tipo CWE-352

6057 resultados

Falsificação de Requisição Entre Sites (CSRF)

A aplicação não valida se uma requisição legítima foi realmente iniciada pelo usuário autenticado, permitindo que um atacante force ações em nome da vítima. Um invasor engana o navegador do usuário a enviar requisições maliciosas para um site onde a vítima está logada, explorando a confiança automática do navegador.

Ejemplo

Um usuário logado em seu banco recebe um email com um link que, ao clicar, faz uma requisição invisível para transferir dinheiro. Como o navegador envia automaticamente os cookies de sessão do banco, a transferência é processada sem confirmação adicional do usuário.

Cómo mitigar

Implemente tokens CSRF únicos por sessão (validados em cada requisição POST/PUT/DELETE), use o padrão SameSite nos cookies, e exija confirmação do usuário para ações críticas. Frameworks modernos como Laravel, Django e Express têm proteção nativa — ative por padrão.

CVE-2020-36735MEDIUMWP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2020-36736MEDIUMWooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2020-36737MEDIUMImport / Export Customizer Settings <= 1.0.3 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2020-5335MEDIUMRSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could EPSS 0.5%CVE-2024-22859HIGHCross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken fuEPSS 0.5%CVE-2023-27889HIGHCross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hEPSS 0.5%CVE-2020-23593MEDIUMA vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attackeEPSS 0.5%CVE-2020-13674—The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and EPSS 0.5%CVE-2024-9665MEDIUMZimbra GraphQL Cross-Site Request Forgery Information Disclosure VulnerabilityEPSS 0.5%CVE-2008-3938HIGHCross-site request forgery (CSRF) vulnerability in user_admin.php in Open Media Collectors Database (OpenDb) 1.0.6 allows remote attackers tEPSS 0.5%CVE-2021-25976HIGHPiranha CMS - Site-wide Cross-Site Request Forgery (CSRF)EPSS 0.5%CVE-2022-36373MEDIUMWordPress MP3 jPlayer plugin <= 2.7.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesEPSS 0.5%CVE-2022-20787MEDIUMCisco Unified Communications Products Cross-Site Request Forgery VulnerabilityEPSS 0.5%CVE-2023-6766MEDIUMPHPGurukul Teacher Subject Allocation Management System Delete Course course.php cross-site request forgeryEPSS 0.5%CVE-2023-25767HIGHA cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connEPSS 0.5%CVE-2024-38276HIGHmoodle: CSRF risks due to misuse of confirm_sesskeyEPSS 0.5%CVE-2020-36707HIGHComing Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request ForgeryEPSS 0.5%CVE-2024-56924HIGHA Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JEPSS 0.5%CVE-2021-39133HIGHCross-Site Request Forgery (CSRF) can run untrusted code on Rundeck serverEPSS 0.5%CVE-2022-42751HIGHCandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffeEPSS 0.5%