|
|
|
|
CWE-352 Individual Dictionary Definition (Draft 9)
Compound Element ID
| Status: Incomplete 352 (Compound Element Variant: Composite) | | Description | Summary The web product does not, or can not, sufficiently verify whether a
well-formed, valid, consistent request was intentionally provided by the user who
submitted the request. Note: CSRF is multi-channel: 1. Attacker-to-victim (injection;
external or internal channel) 2. Victim-to-server (activation; internal channel) | | Alternate Terms | Session Riding Cross Site Reference Forgery XSRF | | Observed Examples | | | Context Notes | Could be resultant from XSS, although XSS is not necessarily required. | | References | | | Relationships | | | Source Taxonomies | PLOVER - Cross-Site Request Forgery (CSRF) | | Applicable Platforms | All | | Time of Introduction | Architecture and Design | | Related Attack Patterns | | CAPEC-ID | Attack Pattern Name |
|---|
| 62 | Cross Site Request Forgery (aka Session Riding) |
|
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
