Falhas do tipo CWE-352

6.072 resultados

Falsificação de Solicitação entre Sites (CSRF)

A aplicação web não valida adequadamente se uma requisição legítima foi realmente originada da intenção do usuário autenticado, ou se foi forjada por um atacante. Um site malicioso consegue fazer seu navegador enviar requisições em seu nome para a aplicação vulnerável, executando ações sem seu consentimento explícito.

Exemplo

Um usuário logado em seu banco recebe um email com um link ou imagem oculta que, ao ser acessado, força seu navegador a enviar uma requisição para transferir dinheiro — a aplicação processa a transferência porque reconhece o cookie de sessão válido, mas nunca verificou se o usuário realmente quis fazer isso.

Como mitigar

Implemente tokens CSRF únicos por sessão (gerados no servidor, incluídos em formulários e validados antes de processar) e use atributos SameSite em cookies de sessão. Para APIs, valide headers customizados como X-Requested-With e implemente CORS restritivo.

CVE-2023-2286MEDIUMWP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanupEPSS 0.3%CVE-2018-19948LOWThe vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerabilEPSS 0.3%CVE-2023-3199MEDIUMMStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title UpdateEPSS 0.3%CVE-2024-39022HIGHidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=dealEPSS 0.3%CVE-2023-3202MEDIUMMStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key UpdateEPSS 0.3%CVE-2023-3407MEDIUMSubscribe2 <= 10.40 - Cross-Site Request ForgeryEPSS 0.3%CVE-2023-3427MEDIUMSalon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customerEPSS 0.3%CVE-2024-23094HIGHFlusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_media_gallery/action/edEPSS 0.3%CVE-2023-53688MEDIUMNagios XI < 5.11.3 XSS & CSRF via Hypermap ReplayEPSS 0.3%CVE-2024-39023HIGHidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=closeEPSS 0.3%CVE-2024-40037HIGHidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=delEPSS 0.3%CVE-2024-42623HIGHFrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1EPSS 0.3%CVE-2024-42608HIGHPligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php.EPSS 0.3%CVE-2024-40039HIGHidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=delEPSS 0.3%CVE-2024-39063HIGHLime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POSTEPSS 0.3%CVE-2023-29815HIGHmccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).EPSS 0.3%CVE-2024-42630HIGHFrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.EPSS 0.3%CVE-2023-27633MEDIUMWordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2024-42607HIGHPligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=databaseEPSS 0.3%CVE-2024-35556HIGHidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet.EPSS 0.3%