Which term is used to describe the vulnerability that can be exploited via authenticated sessions by insecure code?

• A. XSS
• B. CVSS
• C. Cryptography
• D. CSRF

Answer: (D)

Cross-Site Request Forgery occurs when an attacker tricks a user into making a request to a site where they’re already authenticated, and the site trusts the browser’s request. If the application’s code doesn’t verify where the request came from or lacks anti-CSRF protections, the user’s browser will automatically include session cookies with the forged request, making the action appear legitimate and performed by the authenticated user. This means the attacker can cause unwanted state-changing operations without the user’s consent, simply by tempting them to visit a malicious page or click a link.

XSS involves injecting and running scripts in the victim’s browser, which can enable many things but is a different mechanism than CSRF. CVSS is a scoring system, not a vulnerability type. Cryptography is about encryption, not a vulnerability exploited via authenticated sessions.