CWE-650: Trusting HTTP Permission Methods on the Server Side
The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource.
A kind of CWE-436 Interpretation Conflict.
From the CWE List. © The MITRE Corporation.
Newest
- ibm websphere application server IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities 4.3 Medium
- ibm websphere application server IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities 5.9 Medium
- zhinianboke xianyu-auto-reply zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side 5.3 Medium
- dfir-iris iris-web IRIS has a Cross-Site Request Forgery (CSRF) issue 4.3 Medium
- churchcrm crm ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php) 8.1 High
- ibm websphere application server, websphere application server liberty +1 more IBM WebSphere Application Server information disclosure 3.7 Low
- dell avamar, avamar server, avamar virtual edition +2 more Dell Avamar, versions prior to 19.12 with patch 338905, excluding version 19.10SP1 with patch... 8.3 High
- sap s\/4 hana, sap se s/4 hana (manage bank statements) +1 more HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements) 4.3 Medium
- ibm aspera faspex IBM Aspera Faspex bypass security 5.9 Medium
- ibm aspera faspex IBM Aspera Faspex bypass security 6.8 Medium
- ibm application gateway, security verify access, security verify access appliance +1 more +3 more IBM Security Verify Access information disclosure 8.7 High
- ibm powersc IBM PowerSC weak security 5.3 Medium
- solarwinds security event manager, sem +1 more Insecure Methods Vulnerability 5.3 Medium