Falhas do tipo CWE-352

6.260 resultados

Falsificação de Solicitação entre Sites (CSRF)

A aplicação web não valida adequadamente se uma requisição legítima foi realmente originada da intenção do usuário autenticado, ou se foi forjada por um atacante. Um site malicioso consegue fazer seu navegador enviar requisições em seu nome para a aplicação vulnerável, executando ações sem seu consentimento explícito.

Exemplo

Um usuário logado em seu banco recebe um email com um link ou imagem oculta que, ao ser acessado, força seu navegador a enviar uma requisição para transferir dinheiro — a aplicação processa a transferência porque reconhece o cookie de sessão válido, mas nunca verificou se o usuário realmente quis fazer isso.

Como mitigar

Implemente tokens CSRF únicos por sessão (gerados no servidor, incluídos em formulários e validados antes de processar) e use atributos SameSite em cookies de sessão. Para APIs, valide headers customizados como X-Requested-With e implemente CORS restritivo.

CVE-2020-16208—The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a deviceEPSS 1.2%CVE-2018-0439—Cisco Meeting Server Cross-Site Request Forgery VulnerabilityEPSS 1.2%CVE-2018-1098—A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request toEPSS 1.2%CVE-2019-6561—Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.EPSS 1.2%CVE-2018-0413—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.2%CVE-2026-75779HIGHImproper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS EPSS 1.2%CVE-2018-10895CRITICALqutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A maliciEPSS 1.2%CVE-2020-15182HIGHCross-site Request Forgery leading to RCE in SOY CMSEPSS 1.2%CVE-2018-15438MEDIUMCisco Prime Collaboration Assurance Cross-Site Request Forgery VulnerabilityEPSS 1.2%CVE-2018-0210—A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker tEPSS 1.2%CVE-2017-12253—A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted actions. The vuEPSS 1.2%CVE-2025-5888MEDIUMjsnjfz WebStack-Guns cross-site request forgeryEPSS 1.1%CVE-2017-3187—The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgeryEPSS 1.1%CVE-2017-2688—The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to perform actions with tEPSS 1.1%CVE-2025-23922CRITICALWordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerabilityEPSS 1.1%CVE-2019-1713HIGHCisco Adaptive Security Appliance Software Cross-Site Request Forgery VulnerabilityEPSS 1.1%CVE-2019-10186MEDIUMA flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading aEPSS 1.1%CVE-2024-40815HIGHA race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS VenturaEPSS 1.1%CVE-2022-2441HIGHImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command ExecutionEPSS 1.1%CVE-2025-27189MEDIUMAdobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)EPSS 1.0%