An authenticated browser sends a sensitive change request without a CSRF defense. A tester demonstrates that another site can trigger that request using the victim's session. Which weakness is shown?

1. An offline dictionary attack
2. A VLAN hopping attack
3. Stored password hashing
4. Cross-site request forgery