Which vulnerability allows unintended actions in an authenticated session due to insecure coding practices?

Which vulnerability allows unintended actions in an authenticated session due to insecure coding practices?

• A. XSS
• B. Cryptography
• C. CVSS
• D. CSRF

Answer: (D)

Cross-Site Request Forgery (CSRF) is the vulnerability that lets unintended actions happen in an authenticated session by abusing the browser’s trust in the user’s credentials. When someone is logged in, the site relies on the browser to automatically send the session cookie with each request. If the site doesn’t add extra verification for critical actions, a malicious page can cause the user’s browser to submit a forged request to the trusted site. The request includes the legitimate session cookie, so the site treats it as if the user themselves initiated it, carrying out the unwanted action without their consent. Preventing CSRF involves anti-CSRF tokens, same-site cookie settings, or requiring additional verification for sensitive operations. XSS, in contrast, is about injecting malicious scripts into a page to run in the user’s browser and potentially steal data or perform actions via the compromised page. Cryptography refers to techniques for securing data, not a vulnerability type, and CVSS is a scoring system for vulnerabilities, not a vulnerability itself.

Cross-Site Request Forgery (CSRF) is the vulnerability that lets unintended actions happen in an authenticated session by abusing the browser’s trust in the user’s credentials. When someone is logged in, the site relies on the browser to automatically send the session cookie with each request. If the site doesn’t add extra verification for critical actions, a malicious page can cause the user’s browser to submit a forged request to the trusted site. The request includes the legitimate session cookie, so the site treats it as if the user themselves initiated it, carrying out the unwanted action without their consent. Preventing CSRF involves anti-CSRF tokens, same-site cookie settings, or requiring additional verification for sensitive operations.

XSS, in contrast, is about injecting malicious scripts into a page to run in the user’s browser and potentially steal data or perform actions via the compromised page. Cryptography refers to techniques for securing data, not a vulnerability type, and CVSS is a scoring system for vulnerabilities, not a vulnerability itself.