Fallos del tipo CWE-352

6260 resultados

Falsificação de Requisição Entre Sites (CSRF)

A aplicação não valida se uma requisição legítima foi realmente iniciada pelo usuário autenticado, permitindo que um atacante force ações em nome da vítima. Um invasor engana o navegador do usuário a enviar requisições maliciosas para um site onde a vítima está logada, explorando a confiança automática do navegador.

Ejemplo

Um usuário logado em seu banco recebe um email com um link que, ao clicar, faz uma requisição invisível para transferir dinheiro. Como o navegador envia automaticamente os cookies de sessão do banco, a transferência é processada sem confirmação adicional do usuário.

Cómo mitigar

Implemente tokens CSRF únicos por sessão (validados em cada requisição POST/PUT/DELETE), use o padrão SameSite nos cookies, e exija confirmação do usuário para ações críticas. Frameworks modernos como Laravel, Django e Express têm proteção nativa — ative por padrão.

CVE-2021-24981—Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File UploadEPSS 0.8%CVE-2022-1918HIGHToolBar to Share <= 2.0 - Cross-Site Request Forgery to Cross-Site ScriptingEPSS 0.8%CVE-2018-0216—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 0.8%CVE-2017-9641—PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. OSIsoft recommends that useEPSS 0.8%CVE-2022-0197MEDIUMCross-Site Request Forgery (CSRF) in phoronix-test-suite/phoronix-test-suiteEPSS 0.8%CVE-2014-0594HIGHCSRF protection incorrectly disabledEPSS 0.8%CVE-2018-0107—A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actiEPSS 0.8%CVE-2017-6756—A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, reEPSS 0.8%CVE-2018-0148—A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) SupervEPSS 0.8%CVE-2017-7926—A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0). The vulnerability allows cross-site EPSS 0.8%CVE-2016-9365HIGHAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions pEPSS 0.8%CVE-2021-24555—Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL InjectionEPSS 0.8%CVE-2022-0215HIGHXootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options UpdateEPSS 0.8%CVE-2025-28062HIGHA Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perEPSS 0.8%CVE-2024-12955MEDIUMPHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgeryEPSS 0.8%CVE-2019-17633—For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of EPSS 0.8%CVE-2024-20254CRITICALMultiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, EPSS 0.8%CVE-2019-1874HIGHCisco Prime Service Catalog Cross-Site Request Forgery VulnerabilityEPSS 0.8%CVE-2022-1749HIGHWPMK Ajax Finder <= 1.0.1 - Cross-Site Request Forgery to Cross-Site ScriptingEPSS 0.8%CVE-2016-9455—Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulEPSS 0.8%