1827
CanPrecede 352 Cross-Site Request Forgery (CSRF) 868
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Web Based (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Non-Repudiation
Access Control
Modify Application Data
If the website does not impose additional defense against
CSRF attacks, failing to use the 'Lax' or 'Strict' values
could increase the risk of exposure to CSRF attacks.
The likelihood of the integrity breach is Low because a
successful attack does not only depend on an insecure
SameSite attribute. In order to perform a CSRF attack
there are many conditions that must be met, such as the
lack of CSRF tokens, no confirmations for sensitive actions
on the website, a "simple" "Content-Type" header in the
HTTP request and many more.
Low
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
CWE Version 4.14
CWE-1275: Sensitive Cookie with Improper SameSite Attribute
CWE-1275: Sensitive Cookie with Improper SameSite Attribute