Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Implementation

Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Architecture and Design

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and Design

Use the "double-submitted cookie" method as described by Felten and Zeller:
When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Architecture and Design

Do not use the GET method for any request that triggers a state change.
Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

66 results · Clear filters · Feed

High 8.8

CVE-2023-5961 Public exploit

ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be …

Moxa ioLogik E1200 Series ICS / OT

Dec 23, 2023
High 8.8

CVE-2022-41622 Public exploit EPSS 92%

iControl SOAP vulnerability

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

F5 BIG-IP BIG-IQ Centralized Management Network devices

Dec 7, 2022
High 8.8

CVE-2020-23592 Public exploit

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

Nov 23, 2022
High 8.8

CVE-2020-23585 Public exploit

A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2…

Nov 23, 2022
High 8.8

CVE-2020-18326 Public exploit

Cross Site Request Forgery in intelliants/subrion

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary …

intelliants/subrion Packagist

Mar 4, 2022
High 8.8

CVE-2021-46366 Public exploit

Cross-Site Request Forgery in Magnolia CMS

An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.

info.magnolia:magnolia-core Maven

Feb 11, 2022
High 8.8

CVE-2021-46398 Public exploit

Cross-Site Request Forgery in Filebrowser

A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands …

github.com/filebrowser/filebrowser/v2 Go

Feb 4, 2022
High 8.8

CVE-2019-7357 Public exploit

Subrion CMS CSRF Vulnerability

Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.

intelliants/subrion Packagist

Nov 10, 2020
High 8.6

CVE-2020-4040 Public exploit

CSRF issue on preview pages in Bolt CMS

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of p…

bolt bolt bolt/bolt bolt Azure Linux Packagist

Jun 8, 2020
High 8.8

CVE-2019-13529 Public exploit

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actio…

SMA Solar Technology Sunny WebBox

Oct 9, 2019
High 8.8

CVE-2019-12624 Public exploit EPSS 18%

Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected …

Cisco Cisco IOS XE Software iOS Network devices

Aug 21, 2019
High 8.8

CVE-2019-1010054 Public exploit

Dolibarr Cross Site Request Forgery (CSRF)

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encrypta…

Dolibarr ERP & CRM Dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist

Jul 18, 2019
High 8.8

CVE-2019-10874 Public exploit

Bolt Cross Site Request Forgery (CSRF)

Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.

bolt/bolt Packagist

Apr 5, 2019
High 8.8

CVE-2018-15845 Public exploit

Gleez CMS CSRF Allows Adding of Administrator Accounts

There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.

gleez/cms Packagist

Aug 25, 2018
High 8.8

CVE-2018-14057 Public exploit

Pimcore CSRF Vulnerability

Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.

pimcore/pimcore Packagist

Aug 17, 2018
High —

CVE-2018-12540 Public exploit

High severity vulnerability that affects io.vertx:vertx-web

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.

The Eclipse Foundation Eclipse Vert.x io.vertx:vertx-web Maven

Jul 12, 2018
High 8.8

CVE-2018-10188 Public exploit

phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution

phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.

phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Alpine Packagist

Apr 19, 2018
High 8.0

CVE-2018-8718 Public exploit

Cross-Site Request Forgery in Jenkins Mailer Plugin

Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.

org.jenkins-ci.plugins:mailer Maven

Mar 27, 2018
High 8.8

CVE-2017-1000499 Public exploit

phpMyAdmin CSRF Vulnerability

phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.

phpmyadmin/phpmyadmin Packagist

Jan 3, 2018
High 8.8

CVE-2017-16570 Public exploit

Cross-Site Request Forgery (CSRF) in keystone

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.

keystone npm

Nov 6, 2017
High 8.8

CVE-2017-16244 Public exploit

October CMS CSRF

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving …

october/october Packagist

Nov 1, 2017
High 8.8

CVE-2015-7293 Public exploit

Plone vulnerable to cross-site request forgery

Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

plone PyPI

Sep 25, 2017
High 8.8

CVE-2017-6086 Public exploit

ViMbAdmin CSRF Vulnerabilities

Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request …

opensolutions/vimbadmin Packagist

Jun 27, 2017
High 8.8

CVE-2016-6277 Exploited Public exploit Scanner template EPSS 100%

NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.…

Dec 14, 2016
KEV Mar 7, 2022
High 8.0

CVE-2014-100005 Exploited Public exploit EPSS 43%

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17…

Jan 13, 2015
KEV May 16, 2024
High 8.1

CVE-2008-4128 Exploited Public exploit EPSS 34%

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on th…

Sep 18, 2008
KEV Jul 13, 2026