CWE-352
Compound Element ID:352(Compound Element Variant: Composite)
Status: Draft
ソスNソスソスソスXソスTソスCソスgソスソスソスNソスGソスXソスgソスtソスHソス[ソスWソスFソスソス
ソスソスソス
ソスソスソスソスvソスソス
ソス{ソスニ弱性ソスソスソスソスソスンゑソスソスソス Web ソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスヘ、ソスtソスHソス[ソス}ソスbソスgソスノ会ソスソスソスソスソスソスAソステ難ソスソスナ茨ソスム撰ソスソスフゑソスソス驛奇ソスNソスGソスXソスgソスソスソスAソスソスソスMソスソスソスソスソスソスソス[ソスUソスフ意図ソスハゑソスノ渡ソスソスソス黷スソスソスソスフゑソスソスソスソス\ソスソスソスノ鯉ソスソスリゑソスソスネゑソスソスAソスソスソス驍「ソスヘ鯉ソスソスリゑソスソスsソスツ能ソスナゑソスソスB
ソスレ細な会ソスソス
Web ソスTソス[ソスoソスソスソスソスソスNソスGソスXソスgソスソスソスソスソスリゑソスソスソスソスノ受け趣ソスソス謔、ソスン計ソスソスソスソストゑソスソスソス鼾ソスAソスUソスソスソスメゑソスソスNソスソスソスCソスAソスソスソスgソスソスソスxソスソスソスAソスモ図ソスソスソスネゑソスソスソスソスNソスGソスXソスgソスソス Web ソスTソス[ソスoソスノ托ソスソスMソスソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスBソスソスソスフ場合ソスAWeb ソスTソス[ソスoソスヘゑソスソスフソスソスNソスGソスXソスgソス正規ソスフゑソスソスフとゑソスソスト趣ソス闊オソスソスソスワゑソスソスB
ソスソスソスフ攻ソスソスソスソスURLソスAソス鞫懶ソスフ読み搾ソスソスン、XMLHttpRequest ソスソスソスソスソスしソスト行ソスソスソスAソスfソス[ソス^ソスフ漏ソスソスソスソスソスソスモ図ソスソスソスネゑソスソスRソス[ソスhソスフ趣ソスソスsソスソスソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB
ソスハ厄ソス
ソスZソスbソスVソスソスソスソスソスソスソスCソスfソスBソスソスソスO
ソスNソスソスソスXソスTソスCソスgソスソスソスtソス@ソスソスソスソスソスXソスtソスHソス[ソスWソスFソスソス
XSRF
ソスソスソス_ソスIソスネ補足
CSRFソスフトソス|ソスソスソスWソス[ソスヘ、ソスソスソスソスソスフ経ソスHソスノ渡ソスソスワゑソスソスB
1. ソスUソスソスソスメゑソスソスソスAソスソスソスすソス驛ソス[ソスUソスノ対ゑソスソスト。ソスソスソスソスソスソスソスソスソスソスソスヘ外ソスソスソスフ経ソスHソスノゑソスソスソスソスト搾ソスpソスソスソスワゑソスソスB
2. ソスソスソスすソス驛ソス[ソスUソスソスソスソスAソス]ソスソスソスニなゑソスTソス[ソスoソスノ対ゑソスソスト。ソスソスソスソスソスフ経ソスHソスノゑソスソスソスソスト搾ソスpソスソスソスワゑソスソスB
ソスニ弱性ソスフ費ソスソスソスソスソスソスソス
ソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計
ソスYソスソスソスソスソスソスvソスソスソスbソスgソスtソスHソス[ソスソス
ソスソスソスソス
ソスソスソスソスノ依托ソス
ソスソスソスソス
WebソスTソス[ソスo
ソスソスハ的ソスネ影ソスソス
ソスeソスソスソスソスソスけゑソスヘ茨ソス | ソスeソスソス |
---|---|
ソス@ソスソスソスソス ソスソスソスSソスソス ソスツ用ソスソス |
ソスZソスpソスIソスCソスソスソスpソスNソスgソスFソスソスソスソスソスフ取得ソスソスネりすソスワゑソスソスAソスhソス艫ソスJソスjソスYソスソスソスフ会ソスソスソスAソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスfソス[ソス^ソスフ読み趣ソスソス ソスdソス蜷ォソスソス CSRF ソスフ脆弱性ソスソスソスソスソスンゑソスソスソス@ソス\ソスフ撰ソスソスソスソスノゑソスソスソスト変ゑソスソスワゑソスソスBソスUソスソスソスメは趣ソスソスソスソスソスAソスソスQソスメと難ソスソスソスソス謔、ソスノ托ソスソスソスソスソスsソスソスソスソスソスニゑソスソスツ能ソスナゑソスソスBソスソスQソスメゑソスソスヌ暦ソスソスメゑソスソス驍「ソスヘ鯉ソスソスソスソスフゑソスソス驛ソス[ソスUソスソスソスソスソスソスソス鼾ソスノは、web ソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスフ奇ソスソスSソスネコソスソスソスgソスソスソス[ソスソス(ソスfソス[ソス^ソスフ削除ソスソズ趣ソスAソスソスソスiソスフアソスソスソスCソスソスソスXソスgソス[ソスソスソス竦サソスiソスフ全ソストのソスソス[ソスUソスノ対ゑソスソスソスUソスソスソスフ奇ソスユとゑソスソストの暦ソスソスpソスソス)ソスソス^ソスソスソス驍アソスニになゑソスワゑソスソスBソスUソスソスソスメは費ソスQソスメの趣ソスソスハゑソスソスソスソスソスソストゑソスソス驍スソス゚、CSRF ソスフ及ソスヤ範囲は費ソスQソスメの趣ソスソスツ鯉ソスソスソスソスソスソスノ撰ソスソスソスソスソスソスソスワゑソスソスB |
ソスUソスソスソスソスソスけゑソスツ能ソスソス
ソスソスソス`ソスソス
ソスソスソスoソスソスi
ソス闢ョソスソスソスソス
ソス{ソスニ弱性ソスヘペソスlソスgソスソスソス[ソスVソスソスソスソスソスeソスXソスgソスAソスソスソスミソスソスfソスソスソスyソスム趣ソスソスソスソスメゑソスソスAソスNソスeソスBソスuソスZソスbソスVソスソスソスソスソスソスマ更ソスAソスLソス^ソスナゑソスソスソスCソスソスソス^ソスソスソスNソスeソスBソスuソスネツソス[ソスソスソスフようソスネ、ソス闢ョソスフ(ソスlソスノゑソスソスjソスソスソスヘゑソスKソスvソスニゑソスソスソスZソスpソスニツソス[ソスソスソスノゑソスソスソスト鯉ソスソスoソスツ能ソスナゑソスソスB
ソスソスフ的ソスノは、ソス闢ョソスノゑソス髟ェソスヘは本ソスニ弱性ソスフ費ソスソスソスソスノ有ソスソスソスナゑソスソスソスAソスrソスWソスlソスXソスソスソスWソスbソスNソス理会ソスソスソスソストゑソスソスソスホフソスHソス[ソスソスソスXソス|ソスWソスeソスBソスuソスソスソスナ擾ソスソスソスソスソスソスワゑソスソスBソスソスソスソスソスソスソスAソスソスソスヤ的ソスネ撰ソスソスソスフ抵ソスソスナコソス[ソスhソスSソストを分析ゑソスソス驍アソスニは不ソスツ能ソスナゑソスソス蛯、ソスBソスuソスソスソスbソスNソス{ソスbソスNソスXソスソスソスヘにゑソスソスソスソスト難ソスソスソスソスAソスJソスEソスソスソスgソスフ擾ソスがなゑソスソス鼾ソスAソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスノゑソスソスソスソストセソスLソスソスソスソスソスeソスBソスソスナゑソスソスdソスvソスネ包ソスソスソスソスヨの配ソスソスソスソスソス\ソスソスソスナはなゑソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB
ソスソスソスン的ソスネ厄ソスソスソスソスソス閧オソスAソス闢ョソスソスソスヘに役立ゑソス OWASP CSRFTester ソスフ暦ソスソスpソスソスソスソスソスソスソスソスソスソスワゑソスソスB
ソスLソスソスソスソスソスFソスソス
ソス闢ョソスソスソスヘは奇ソスソスSソスノ趣ソスソスソスソスソスソスソスソス黷スソスソスiソスソスソスソスソスソスソスハ的ソスナゑソスソスBソスニ弱性ソスソスソスン計ソスyソスムビソスWソスlソスXソスソスソス[ソスソスソスノ関係ソスソスソスソス鼾ソスノ難ソスソスノ有ソスソスソスナゑソスソスB
ソスソスソスソスソステ的ソスソスソスソス
ソスソスソスンのとゑソスソスソスACSRF ソスヘ趣ソスソスソスソスソスソスヘゑソスソスgソスpソスソスソストゑソスソスmソスソスソスノ防ソスソスソスソスソスニは搾ソスソスソスナゑソスソスBソスソスソスソスヘ、ソスeソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスソスソスソスソス黷シソスソスAソスOソスソスソスソスソスソスフ影ソスソスソスソスソスけるリソスNソスGソスXソスgソスソスソスソスソスソスtソスソスソスソステ黙のセソスLソスソスソスソスソスeソスBソス|ソスソスソスVソス[ソスソスソスソスソスソスソストゑソスソス驍アソスニ、ソスyソスムソスソス[ソスUソスソスソス成ソスソスソス謔、ソスニゑソスソス驛奇ソスNソスGソスXソスgソスノ対ゑソスソス骰ゑソスソスソスMソスソスソスソスvソスソスソスソスソス驛奇ソスNソスGソスXソスgソスノ対ゑソスソスト、ソスソスソス[ソスUソスフ托ソスソスソスノ趣ソスソスソスソスソスソスsソスソスソストゑソスソス驍アソスニゑソスソスソスソスソスソスナゑソスソスBソス痰ヲソスホ、web ソスTソスCソスgソスフ鯉ソスソスJソスソスソスソスソスノゑソスソスソスLソス[ソスソスソス[ソスhソスソスソスソスソスヘ、ソスソスハ的ソスノソスソス[ソスUソスソスソスソスソスソスソスNソスソスソスNソスソスソスbソスNソスソスソスソスソスソスソスソスソスニゑソスソスノ趣ソスソスソスソスIソスノ趣ソスソスsソスソスソスソス驛奇ソスソスソスNソスソスソスナエソスソスソスRソス[ソスhソスソスソスソス驍アソスニゑソスソスソスソスメゑソスソスソストゑソスソスワゑソスソスB
ソスLソスソスソスソスソスFソスソスソスソスI
ソスニ趣ソスネコソス[ソスhソスソス
ソスソス 1:
ソスソスソスソス PHP ソスフコソス[ソスhソスソスヘ、ソスソスソス[ソスUソスフ難ソスソスeソスソスソスKソスリなセソスbソスVソスソスソスソスソスソスソスソスソスソスソストゑソスソス驍アソスニゑソスソスmソスFソスソスソス驍アソスニにゑソスソスAソスtソスHソス[ソスソスソスフ難ソスソスeソスソスソスソスソスソスソスソスソスSソスノゑソスソス謔、ソスニゑソスソスソスソスソスソスフでゑソスソスBソスソスソスソスソスソスソスAソスUソスソスソスメは適ソスリなセソスbソスVソスソスソスソスソスソスソスソスソスナに保趣ソスソスソスソストゑソスソス驛ソス[ソスUソスソス web ソスuソスソスソスEソスUソスソスソスソスフソスソスNソスGソスXソスgソスソスソスUソスソスソスソスソス驍スソス゚、CSRF ソスUソスソスソスヘゑソスソスフ対搾ソスナは防ソスソスソスソスソスニゑソスソスナゑソスソスワゑソスソスソスB ソスネ会ソスソスソス HTML ソスヘソスソス[ソスUソスノプソスソスソスtソスBソス[ソスソスソスフアソスbソスvソスfソス[ソスgソスソスソスsソスせソス驍スソス゚のゑソスソスフでゑソスソスB
Example Language: HTML (Bad Code)
<form action="/url/profile.php" method="post"> <input type="text" name="firstname"/> <input type="text" name="lastname"/> <br/> <input type="text" name="email"/> <input type="submit" name="submit" value="Update"/> </form>
profile.php ソスノは、ソスネ会ソスソスフコソス[ソスhソスソスソスワまゑソストゑソスソスワゑソスソスB
Example Language: PHP (Bad Code)
// initiate the session in order to validate sessions session_start(); //if the session is registered to a valid user then allow update if (! session_is_registered("username")) { echo "invalid session detected!"; // Redirect user to login page [...] exit; } // The user session is valid, so process the request // and update the information update_profile(); function update_profile { // read in the data from $POST and send an update // to the database SendUpdateToDatabase($_SESSION['username'], $_POST['email']); [...] echo "Your profile has been successfully updated."; }
ソス鼬ゥソスAソスKソスリなセソスbソスVソスソスソスソスソスソスソスmソスFソスソスソストゑソスソス驍スソス゚ゑソスソスフコソス[ソスhソスヘ保護さソスソストゑソスソスソス謔、ソスノ鯉ソスソスソスソスワゑソスソスBソスソスソスソスソスソスソスACSRF ソスUソスソスソスヘ趣ソスソスソスソスIソスノ、image ソス^ソスOソスAソスソスソスソスソスNソスAソスソスソス゚搾ソスソスンゑソス object ソス^ソスO ソスワゑソスソスヘ、ソスwソスiソスCソスソスソス[ソスWソスソスソストび出ソスソスソスソスソスフ托ソスソスフ托ソスソスソスソスソスソスワめてゑソスソスソスAソスソスソスソスソスソス^ソスOソスソス HTML ソス\ソスソスソスソスソスソスソスソスsソスツ能ソスナゑソスソスB
ソスUソスソスソスメは、ソスWソスIソスソス web ソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスノソスソスOソスCソスソスソスソスソストゑソスソスソスヤにペソス[ソスWソスソスKソス黷スソスソスソスソスソス驛ソス[ソスUソスフソスソス[ソスUソスソスソス窿ソス[ソスソスソスAソスhソスソスソスXソスソスマ更ソスソスソスソスRソス[ソスhソスソスソスソスソスフばゑソスソス驍アソスニゑソスソスツ能ソスナゑソスソスBソスソスソスフコソス[ソスhソスヘ以会ソスソスフようソスノ厄ソスソスQソスソス web ソスyソス[ソスWソスノ鯉ソスソスソスソスワゑソスソスB
ソスソスソスソスソスソスソス黷スソスソスソスソス
ソスQソスソス | ソスレ搾ソス |
---|---|
CVE-2004-1703 | Add user accounts via a URL in an img tag |
CVE-2004-1995 | Add user accounts via a URL in an img tag |
CVE-2004-1967 | Arbitrary code execution by specifying the code in a crafted img tag or URL |
CVE-2004-1842 | Gain administrative privileges via a URL in an img tag |
CVE-2005-1947 | Delete a victim's information via a URL or an img tag |
CVE-2005-2059 | Change another users settings via a URL or an img tag |
CVE-2005-1674 | Perform actions as administrator via a URL or an img tag |
CVE-2009-3520 | modify password for the administrator |
CVE-2009-3022 | CMS allows modification of configuration via CSRF attack against the administrator |
CVE-2009-3759 | web interface allows password changes or stopping a virtual machine via CSRF |
ソスソスQソスフ緩和ソスソス
ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計
ソス略ソスF ソスソスソスCソスuソスソスソスソスソスAソスtソスソスソス[ソスソスソスソスソス[ソスN
ソス{ソスニ弱性ソスフ費ソスソスソスソスソスhソスソスソスAソスソスソス驍「ソスヘ本ソスニ弱性ソスソスソスソスソスソスソスソス竄キソスソスソス\ソスソスソスソス供ゑソスソスソスAソス\ソスソスソスノ鯉ソスソスソスソスソスソス黷スソスソスソスCソスuソスソスソスソスソスソスtソスソスソス[ソスソスソスソスソス[ソスNソスソスソスgソスpソスソスソストゑソスソスソスソスソスソスソスソスB
ソスソスニゑソスソスト、OWASP CSRFGuard ソスネどゑソスCSRFソスホ搾ソスpソスbソスPソス[ソスWソスソスソスソスソスソスソスソスソスワゑソスソスB
ソスソスソスフ暦ソスニゑソスソストは、CSRF ソスノ対ゑソスソスソスRソスソスソス|ソス[ソスlソスソスソスgソスソスソスソスソスソス ESAPI Session Management control ソスソスソスソスソスソスソスソスソスワゑソスソスB
ソスtソスFソス[ソスYソスFソスソスソスソス
ソスソスソスソスソスソス CSRF ソスホ搾ソスヘ攻ソスソスソスメゑソスソスソスフスソスNソスソスソスvソスgソスノゑソスソスソスソスソスソスソスソス驍スソス゚、ソスソスソスソスソスソスソスソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスノクソスソスソスXソスTソスCソスgソスXソスNソスソスソスvソスeソスBソスソスソスOソスフ厄ソスソス (CWE-79) ソスソスソスソスソスソスソスソスソスニゑソスソスmソスFソスソスソスト会ソスソスソスソスソスソスB
ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計
ソスソスモの暦ソスソスソスソスソスソスtソスHソス[ソスソスソスソスソスノ撰ソスソスソスソスAソスZソスbソスgソスソスソスAソスtソスHソス[ソスソスソスソスソスけ趣ソス髣撰ソスソスソスソスソスソスソスリゑソスソストゑソスソスソスソスソスソスソスソスB
ソスソスソスフ暦ソスソスソスソスヘ撰ソスソスソスソスソスソスソスネゑソスソスフにゑソスソスト会ソスソスソスソスソス (CWE-330).ソスB
ソスソスソスフ緩和ソスソスヘクソスソスソスXソスTソスCソスgソスXソスNソスソスソスvソスeソスBソスソスソスOソスiCWE-79ソスjソスノゑソスソスソスソスソスツ能ソスナゑソスソス驍アソスニに抵ソスソスモゑソスソストゑソスソスソスソスソスソスソスソスB
ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計
ソスソスソスノ危険ソスネ擾ソスソスソスソスソスソスソス閧オソストゑソスソスソスソスソスソスソスソスBソスソスソス[ソスUソスソスソス険ソスネ擾ソスソスソスソスソスソスsソスソスソスソスソス鼾ソスAソスソスソス[ソスUソスソスソスソスソスフ擾ソスソスソスソスソスソスモ図ソスソスソストゑソスソス驍ゥソスソスソスmソスFソスソスソスソスツ別の確ソスFソスソスソスNソスGソスXソスgソス送信ソスソスソストゑソスソスソスソスソスソスソスソスB
ソスソスソスフ緩和ソスソスヘクソスソスソスXソスTソスCソスgソスXソスNソスソスソスvソスeソスBソスソスソスOソスiCWE-79ソスjソスノゑソスソスソスソスソスツ能ソスナゑソスソス驍アソスニに抵ソスソスモゑソスソストゑソスソスソスソスソスソスソスソスB
ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計
Felten ソスソス Zeller ソスフ提唱ゑソスソスソス "double-submitted cookie" ソスソスソス\ソスbソスhソスソスソスgソスpソスソスソスト会ソスソスソスソスソスソスB
ソスソスソスフ趣ソス@ソスソス Javascript ソスソスKソスvソスソスソス驍スソス゚、Javascript ソスソスソスLソスソスソスナなゑソスソスuソスソスソスEソスUソスノは鯉ソスソスハゑソスソスソスソスソスワゑソスソスソスB
ソスソスソスフ緩和ソスソスヘクソスソスソスXソスTソスCソスgソスXソスNソスソスソスvソスeソスBソスソスソスOソスiCWE-79ソスjソスノゑソスソスソスソスソスツ能ソスナゑソスソス驍アソスニに抵ソスソスモゑソスソストゑソスソスソスソスソスソスソスソスB
ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計
ソスソスヤの変更ソスソスソスソスソスソスソスNソスソスソスソスソスSソストのソスソスNソスGソスXソスgソスノゑソスソスソスソスト、GET ソスソスソス\ソスbソスhソスソスソスgソスpソスソスソスネゑソスソスナ会ソスソスソスソスソスソスB
ソスtソスFソス[ソスYソスFソスソスソスソス
ソスモ図ソスソスソスソスソスyソス[ソスWソスソスソス辜奇ソスNソスGソスXソスgソスソスソスソスソスMソスソスソスソストゑソスソス驍ゥソスソスソスmソスFソスソスソス驍スソス゚、HTTP Referer ソスwソスbソス_ソスソスソスmソスFソスソスソスト会ソスソスソスソスソスソスBソスソスソス[ソスUソスソスvソスソスソスLソスVソスソスソスvソスソスソスCソスoソスVソス[ソスソスフ暦ソスソスRソスソス Referer ソスフ托ソスソスMソス無鯉ソスソスノゑソスソストゑソスソスソスツ能ソスソスソスソスソスソスソス驍スソス゚、ソス{ソスソスソスフ機ソス\ソスニゑソスソスト違反ソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB
ソスソスソスフ緩和ソスソスヘクソスソスソスXソスTソスCソスgソスXソスNソスソスソスvソスeソスBソスソスソスOソスiCWE-79ソスjソスノゑソスソスソスソスソスツ能ソスナゑソスソス驍アソスニに抵ソスソスモゑソスソストゑソスソスソスソスソスソスソスソスBソスUソスソスソスメはクソスソスソスXソスTソスCソスgソスXソスNソスソスソスvソスeソスBソスソスソスOソスノゑソスソスソスト、ソスソスソス[ソスUソスノなりすソスワゑソスソスソス Referer ソス生撰ソスソスソスソスソスAソスソスソス驍「ソスソス Referer ソスフ具ソスソスツゑソスソス黷スソスyソス[ソスWソスソスソスソスAソスソスソスモのゑソスソス驛奇ソスNソスGソスXソスgソス生撰ソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB
ソスヨ係ソスソス
Nature | Type | ID | Name | View(s) this relationship pertains to |
---|---|---|---|---|
Requires | Weakness Base | 346 | Origin Validation Error | Research Concepts1000 |
Requires | Weakness Base | 441 | Unintended Proxy/Intermediary | Research Concepts1000 |
Requires | Weakness Base | 613 | Unintended Proxy/Intermediary | Research Concepts1000 |
Requires | Weakness Class | 642 | External Control of Critical State Data | Research Concepts1000 |
ChildOf | Weakness Class | 345 | Insufficient Verification of Data Authenticity | Development Concepts (primary)699 |
Research Concepts (primary)1000 | ||||
ChildOf | Category | 716 | OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF) | Weaknesses in OWASP Top Ten (2007) (primary)629 |
ChildOf | Category | 751 | 2009 Top 25 - Insecure Interaction Between Components | Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (primary)750 |
ChildOf | Category | 801 | 2010 Top 25 - Insecure Interaction Between Components | Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors(primary)800 |
ChildOf | Category | 814 | OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF) | Weaknesses in OWASP Top Ten (2010)(primary)809 |
MemberOf | View | 635 | Weaknesses Used by NVD | Weaknesses Used by NVD (primary)635 |
PeerOf | Weakness Base | 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Research Concepts1000 |
ソスヨ係ソスソスソスフ補足
ソスNソスソスソスXソスTソスCソスgソスXソスNソスソスソスvソスeソスBソスソスソスOソスiXSSソスjソスノゑソスソスACSRF ソスソスソスソスソスソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB
ソスiソスKソスソスソスソスソスソスソスACSRF ソスフ鯉ソスソスソスソスソス XSS ソスナゑソスソスソスニは鯉ソスソスソスワゑソスソスソスBソスj
ソスvソスソスソスソスソスソスソスソス ソスiCWE ソスフ鯉ソスソスソスソスj
ソスソス閧ェソスソスソスソスソスノなゑソスnソス゚ゑソス 2008 ソスNソスOソスソスワでは、CVE ソスノゑソスソスソスソスト過擾ソスソス告ゑソスソスソストゑソスソスワゑソスソスソスソスソスソスACSRF ソスヘほとゑソスヌゑソス Web ソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスノ托ソスソスンゑソスソスソスニ弱性ソスナゑソスソスB
ソスソスソスgソスDソスナの包ソスソスソス
ソスgソスDソスソスソスワゑソスソスヘ組ソスDソスナの包ソスソスソス | ソスmソス[ソスh ID | CWEソスフ包ソスソズとの適ソスソスソスx | ソスソスソズ厄ソス |
---|---|---|---|
PLOVER | Cross-Site Request Forgery (CSRF) | ||
OWASP Top Ten 2007 | A5 | ソスソスソスソス | Cross Site Request Forgery (CSRF) |
WASC | 9 | Cross-site Request Forgery |
ソスヨ連ソスソスソスソスUソスソスソスpソス^ソス[ソスソス
CAPEC-ID | ソスUソスソスソスpソス^ソス[ソスソスソスソス (CAPEC Version 1.5) |
---|---|
62 | Cross Site Request Forgery (aka Session Riding) |
111 | JSON Hijacking (aka JavaScript Hijacking) |
ソスQソスソス
[REF-17] Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security". "Sin 2: Web-Server Related Vulnerabilities (XSS, XSRF, and Response Splitting)." Page 37. McGraw-Hill. 2010.
Peter W. "Cross-Site Request Forgeries (Re: The Dangers of Allowing Users to Post Images)".
Bugtraq. <http://marc.info/?l=bugtraq&m=99263135911884&w=2>.
OWASP. "Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet". <http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet>.
Edward W. Felten and William Zeller. "Cross-Site Request Forgeries: Exploitation and Prevention". 2008-10-18. <http://freedom-to-tinker.com/sites/default/files/csrf.pdf>.
Robert Auger. "CSRF - The Cross-Site Request Forgery (CSRF/XSRF) FAQ". <http://www.cgisecurity.com/articles/csrf-faq.shtml>.
Cross-site request forgery. Wikipedia. 2008-12-22. <http://en.wikipedia.org/wiki/Cross-site_request_forgery>.
Jason Lam. "Top 25 Series - Rank 4 - Cross Site Request Forgery". SANS Software Security Institute. 2010-03-03. <http://blogs.sans.org/appsecstreetfighter/2010/03/03/top-25-series-%E2%80%93-rank-4-%E2%80%93-cross-site-request-forgery/>.
ソスXソスVソスソスソスソス
[2011ソスN04ソスソス21ソスソス]
2010ソスN10ソスソス12ソスソスソスソスソス_ソスフデソス[ソス^ソスソスソスソスソスノ更ソスV
[2009ソスN06ソスソス29ソスソス]
2009ソスN02ソスソス02ソスソスソスソスソス_ソスフ会ソスソスL URL ソスソスソスソスソスノ作成
http://cwe.mitre.org/data/definitions/352.html
ソスoソス^ソスソス 2011/04/21
ソスナ終ソスXソスVソスソス 2023/04/04