873
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 716 OWASP Top Ten 2007 Category A5 - Cross Site
Request Forgery (CSRF)
629 2331
MemberOf 751 2009 Top 25 - Insecure Interaction Between
Components
750 2352
MemberOf 801 2010 Top 25 - Insecure Interaction Between
Components
800 2354
MemberOf 814 OWASP Top Ten 2010 Category A5 - Cross-Site
Request Forgery(CSRF)
809 2358
MemberOf 864 2011 Top 25 - Insecure Interaction Between
Components
900 2371
MemberOf 884 CWE Cross-section 884 2567
MemberOf 936 OWASP Top Ten 2013 Category A8 - Cross-Site
Request Forgery (CSRF)
928 2392
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Notes
Relationship
There can be a close relationship between XSS and CSRF (CWE-352). An attacker might use
CSRF in order to trick the victim into submitting requests to the server in which the requests
contain an XSS payload. A well-known example of this was the Samy worm on MySpace
[REF-956]. The worm used XSS to insert malicious HTML sequences into a user's profile and
add the attacker as a MySpace friend. MySpace friends of that victim would then execute the
payload to modify their own profiles, causing the worm to propagate exponentially. Since the
victims did not intentionally insert the malicious script themselves, CSRF was a root cause.
Theoretical
The CSRF topology is multi-channel: Attacker (as outsider) to intermediary (as user). The
interaction point is either an external or internal channel. Intermediary (as user) to server (as
victim). The activation point is an internal channel.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Cross-Site Request Forgery (CSRF)
OWASP Top Ten 2007 A5 Exact Cross Site Request Forgery (CSRF)
WASC 9 Cross-site Request Forgery
Related Attack Patterns
CAPEC-ID Attack Pattern Name
62 Cross Site Request Forgery
CWE Version 4.14
CWE-353: Missing Support for Integrity Check
CWE-353: Missing Support for Integrity Check