4773 vulnerabilities classified as CWE-352 (跨站请求伪造(CSRF)). AI Chinese analysis included.
CWE-352, Cross-Site Request Forgery, is a web application weakness where the system fails to verify that an incoming request was intentionally initiated by the authenticated user rather than an unauthorized actor. Attackers typically exploit this vulnerability by tricking a victim into submitting a malicious request, often via a hidden link or form on a third-party site, while the victim is logged into the target application. Because the browser automatically includes valid session cookies, the server processes the forged request as legitimate, potentially allowing unauthorized actions like fund transfers or profile changes. Developers mitigate this risk by implementing anti-CSRF tokens, synchronizer tokens, or validating the Origin and Referer headers to ensure requests originate from trusted sources, thereby preventing unauthorized state changes.
<form action="/url/profile.php" method="post"> <input type="text" name="firstname"/> <input type="text" name="lastname"/> <br/> <input type="text" name="email"/> <input type="submit" name="submit" value="Update"/> </form>// initiate the session in order to validate sessions session_start(); //if the session is registered to a valid user then allow update if (! session_is_registered("username")) { echo "invalid session detected!"; // Redirect user to login page [...] exit; } // The user session is valid, so process the request // and update the information update_profile(); function update_profile { // read in the data from $POST and send an update // to the database SendUpdateToDatabase($_SESSION['username'], $_POST['email']); [...] echo "Your profile has been successfully updated."; }| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2018-0259 | Cisco MATE Collector 跨站请求伪造漏洞 — Cisco MATE Collector | 8.8 | - | 2018-04-19 |
| CVE-2018-1098 | etcd 跨站请求伪造漏洞 — etcd | 8.8 | - | 2018-04-03 |
| CVE-2018-7524 | Geutebrück G-Cam/EFD-2250和Topline TopFD-2125 跨站请求伪造漏洞 — Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware | 8.8 | - | 2018-03-22 |
| CVE-2017-0933 | Ubiquiti Networks EdgeOS 跨站请求伪造漏洞 — EdgeRouter X | 8.0 | - | 2018-03-22 |
| CVE-2018-1230 | Pivotal Spring Batch Admin 跨站请求伪造漏洞 — Spring Batch Admin | 8.8 | - | 2018-03-21 |
| CVE-2018-0210 | Cisco Data Center Network Manager 跨站请求伪造漏洞 — Cisco Data Center Network Manager | 8.8 | - | 2018-03-08 |
| CVE-2018-0215 | Cisco Identity Services Engine 跨站请求伪造漏洞 — Cisco Identity Services Engine | 8.8 | - | 2018-03-08 |
| CVE-2018-0216 | Cisco Identity Services Engine 跨站请求伪造漏洞 — Cisco Identity Services Engine | 8.8 | - | 2018-03-08 |
| CVE-2018-0146 | Cisco Data Center Analytics Framework应用程序跨站请求伪造漏洞 — Cisco Data Center Analytics Framework | 8.1 | - | 2018-02-22 |
| CVE-2018-0148 | Cisco UCS Director Software和Cisco Integrated Management Controller Supervisor Software 跨站请求伪造漏洞 — Cisco UCS Director and Cisco Integrated Management Controller Supervisor | 8.8 | - | 2018-02-22 |
| CVE-2018-0107 | Cisco Prime Service Catalog 跨站脚本漏洞 — Cisco Prime Service Catalog | 8.8 | - | 2018-01-18 |
| CVE-2017-5263 | Cambium Networks cnPilot 安全漏洞 — cnPilot | 8.8 | - | 2017-12-20 |
| CVE-2017-5264 | Rapid7 Nexpose 安全漏洞 — Nexpose | 8.8 | - | 2017-12-14 |
| CVE-2017-12271 | Cisco SPA300和SPA500 Series IP Phones 跨站请求伪造漏洞 — Cisco SPA300 and SPA500 Series IP Phones | 8.8 | - | 2017-10-19 |
| CVE-2017-14011 | ProMinent MultiFLEX M10a Controller Web界面跨站请求伪造漏洞 — ProMinent MultiFLEX M10a Controller | 8.8 | - | 2017-10-17 |
| CVE-2017-12253 | Cisco Unified Intelligence Center 跨站请求伪造漏洞 — Cisco Unified Intelligence Center | 8.8 | - | 2017-09-21 |
| CVE-2017-7926 | OSIsoft PI Web API 跨站请求伪造漏洞 — OSIsoft PI Web API 2017 | 8.8 | - | 2017-08-25 |
| CVE-2017-5187 | Micro Focus Enterprise Developer和Enterprise Server Directory Server 跨站请求伪造漏洞 — Micro Focus Enterprise Developer, Micro Focus Enterprise Server | 8.8 | - | 2017-08-21 |
| CVE-2017-7423 | Micro Focus Enterprise Developer和Enterprise Server 跨站请求伪造漏洞 — Micro Focus Enterprise Developer, Micro Focus Enterprise Server | 8.1 | - | 2017-08-21 |
| CVE-2017-7556 | Hawtio 跨站请求伪造漏洞 — hawtio | 8.1 | - | 2017-08-17 |
| CVE-2017-6756 | Cisco Prime Collaboration Provisioning tool 跨站请求伪造漏洞 — Cisco Prime Collaboration Provisioning Tool | 8.8 | - | 2017-08-07 |
| CVE-2017-6038 | Belden Hirschmann GECKO Lite Managed Switch 跨站请求伪造漏洞 — Belden Hirschmann GECKO | 8.1 | - | 2017-06-30 |
| CVE-2017-6042 | Sierra Wireless AirLink Raven XE和XT 跨站请求伪造漏洞 — Sierra Wireless AirLink Raven XE and XT | 8.8 | - | 2017-06-30 |
| CVE-2017-5244 | Rapid7 Metasploit Express、Community和Pro 跨站请求伪造漏洞 — Metasploit (Pro, Express, and Community editions) | 6.5 | - | 2017-06-15 |
| CVE-2017-7917 | 多款摩莎产品跨站请求伪造漏洞 — Moxa OnCell | 8.8 | - | 2017-05-29 |
| CVE-2017-6634 | Cisco Industrial Ethernet 1000 Series Switches 跨站请求伪造漏洞 — Cisco Industrial Ethernet 1000 Series Switches | 8.8 | - | 2017-05-22 |
| CVE-2017-2688 | Siemens RUGGEDCOM ROX I 跨站请求伪造漏洞 — RUGGEDCOM ROX I All versions | 8.8 | - | 2017-03-29 |
| CVE-2016-9127 | Revive Adserver 跨站请求伪造漏洞 — Revive Adserver All versions before 3.2.3 | 6.5 | - | 2017-03-28 |
| CVE-2016-9455 | Revive Adserver 跨站请求伪造漏洞 — Revive Adserver All versions before 3.2.3 | 8.8 | - | 2017-03-28 |
| CVE-2016-9456 | Revive Adserver 跨站请求伪造漏洞 — Revive Adserver All versions before 3.2.3 | 8.8 | - | 2017-03-28 |
Vulnerabilities classified as CWE-352 (跨站请求伪造(CSRF)) represent 4773 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.