Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

2,042 results · Clear filters · Feed

  • High 8.8
    CVE-2024-26273

    Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor

    Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • High 8.8
    CVE-2024-26272

    Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor

    Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • High 8.8
    CVE-2024-26271

    Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget

    Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 3…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • High 7.1
    CVE-2024-49335

    WordPress GoogleDrive folder list plugin <= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through <= 2.2.2.

    sh4d0w28 GoogleDrive folder list
  • High 7.1
    CVE-2024-49605

    WordPress Community Lite Video Chat plugin <= 2.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a through <= 2.2.

    Stefan Nour AVChat Video Chat
  • High 7.1
    CVE-2024-49629

    WordPress Endless Posts Navigation plugin <= 2.2.7 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through <= 2.2.7.

    Fahad Mahmood Endless Posts Navigation
  • High 8.2
    CVE-2024-49615

    WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms safetymails-forms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through <= 1.0.0.

    Henrique Rodrigues SafetyForms
  • High 8.2
    CVE-2024-49617

    WordPress Back Link Tracker plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through <= 1.0.0.

    anciwasim Back Link Tracker
  • High 8.2
    CVE-2024-49621

    WordPress APA Register Newsletter Form plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through <= 1.0.0.

    aatmaadhikari APA Register Newsletter Form
  • High 8.2
    CVE-2024-49622

    WordPress Apa Banner Slider plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari Apa Banner Slider apa-banner-slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through <= 1.0.0.

    aatmaadhikari Apa Banner Slider
  • High 7.1
    CVE-2024-49220

    WordPress Cookie Scanner plugin <= 1.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: from n/a through <= 1.1.

    Nikel Cookie Scanner
  • High 7.1
    CVE-2024-49221

    WordPress cSlider plugin <= 2.4.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a through <= 2.4.2.

    julian.weinert cSlider
  • High 7.1
    CVE-2024-49223

    WordPress CJ Change Howdy plugin <= 3.3.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change Howdy: from n/a through <= 3.3.1.

    shibulijack CJ Change Howdy
  • High 7.1
    CVE-2024-49237

    WordPress Ahmeti Wp Timeline plugin <= 5.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n/a through <= 5.1.

    ahmeti Ahmeti Wp Timeline
  • High 7.1
    CVE-2024-49313

    WordPress VKontakte Wall Post plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in rudestan VKontakte Wall Post vkontakte-wall-post allows Stored XSS.This issue affects VKontakte Wall Post: from n/a through <= 2.0.

    rudestan VKontakte Wall Post
  • High 7.1
    CVE-2024-48048

    WordPress Wsify Widget plugin <= 1.0 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <= 1.0.

    GabbyKhrmon Wsify Widget
  • High 7.1
    CVE-2024-20421

    Cisco ATA 190 Series Analog Telephone Adapter Firmware Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected …

    Cisco Cisco Analog Telephone Adaptor (ATA) Software Network devices
  • High 8.0
    CVE-2024-45693

    Apache CloudStack: Request origin validation bypass makes account takeover possible

    Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users …

    Apache Software Foundation Apache CloudStack
  • High 8.3
    CVE-2020-36839

    WP Lead Plus X <= 0.99 - Cross-Site Request Forgery

    The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perf…

    bc2018 WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X Web / CMS
  • High 8.8
    CVE-2024-8507

    File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload

    The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for una…

    File Manager File Manager Pro Web / CMS
  • High 8.0
    CVE-2020-36836 Scanner template

    WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

    The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users wit…

    Emre Vona WP Fastest Cache – WordPress Cache Plugin Web / CMS
  • High 7.5
    CVE-2024-41344

    A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator pass…

  • High 7.1
    CVE-2024-6959

    Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui

    A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each ch…

    parisneo parisneo/lollms-webui
  • High 7.1
    CVE-2024-44028

    WordPress NiceJob plugin < 3.6.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through < 3.6.5.

    nicejob NiceJob
  • High 8.7
    CVE-2024-43684

    Cross-Site Request Forgery vulnerability in TimeProvider 4100

    Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0.

    Microchip TimeProvider 4100
  • High 8.6
    CVE-2024-41987

    Cross-Site Request Forgery (CSRF) vulnerability in TEM Opera Plus FM Family Transmitter

    The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privil…

    TEM Opera Plus FM Family Transmitter
  • High 8.8
    CVE-2024-8458

    PLANET Technology switch devices - Cross-site Request Forgery

    Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user a…

    PLANET Technology GS-4210-24P2S hardware 3.0 GS-4210-24PL4C hardware 2.0
  • High 8.0
    CVE-2024-28948

    Advantech ADAM-5630 Cross-Site Request Forgery

    Advantech ADAM-5630 contains a cross-site request forgery (CSRF) vulnerability. It allows an attacker to partly circumvent the same origin policy, which is designed to prevent different websites from interfering with each other.

    Advantech ADAM-5630
  • High 8.1
    CVE-2024-20437

    A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote a…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.8
    CVE-2024-8795

    BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover

    The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the my_account_update() function. This makes it possible for unauthen…

    Booking Algorithms BA Book Everything Web / CMS
  • High 8.0
    CVE-2024-46394

    FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add

  • High 8.8
    CVE-2024-46086

    FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_man…

  • High 8.8
    CVE-2024-8490

    PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details

    The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'save_account_details' function. This makes it possible for unauthentic…

    Property Hive Property Hive Web / CMS
  • High 8.8
    CVE-2024-46085

    FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_man…

  • High 8.8
    CVE-2024-46362

    FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_man…

  • High 7.4
    CVE-2024-6862

    Cross-Site Request Forgery (CSRF) in lunary-ai/lunary

    A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local …

    lunary-ai lunary-ai/lunary
  • High 8.8
    CVE-2024-7423

    Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update

    The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated …

    xwp Stream Web / CMS
  • High 8.0
    CVE-2024-45264 Public exploit

    A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remot…

  • High 7.1
    CVE-2024-43301

    WordPress Fonts plugin <= 3.7.7 - Cross Site Request Forgery (CSRF) to Stored XSSvulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fonts Plugin Fonts allows Stored XSS.This issue affects Fonts: from n/a through 3.7.7.

    Fonts Plugin Fonts
  • High 8.8
    CVE-2024-42584

    A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attac…