Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

2,042 results · Clear filters · Feed

  • High 8.8
    CVE-2024-3782

    Cross-Site Request Forgery (CSRF) vulnerability in WBSAirback

    Cross-Site Request Forgery vulnerability in WBSAirback 21.02.04, which could allow an attacker to create a manipulated HTML form to perform privileged actions once it is executed by a privileged user.

    WBSAirback White Bear Solutions
  • High 8.8
    CVE-2024-31424

    WordPress Login with Phone Number plugin <= 1.6.93 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.

    Hamid Alinia Login with phone number
  • High 7.1
    CVE-2024-30545

    WordPress Social Author Bio plugin <= 2.4 - Stored XSS via Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Nick Powers Social Author Bio allows Stored XSS.This issue affects Social Author Bio: from n/a through 2.4.

    Nick Powers Social Author Bio
  • High 7.1
    CVE-2024-31086

    WordPress Change default login logo,url and title plugin <= 2.0 - CSRF to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting (XSS).This issue affects Change default login logo,url and title: from n/a through 2.0.

    Venugopal Change default login logo,url and title
  • High 7.1
    CVE-2024-31093

    WordPress Broken Images plugin <= 0.2 - CSRF to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Kaloyan K. Tsvetkov Broken Images allows Cross-Site Scripting (XSS).This issue affects Broken Images: from n/a through 0.2.

    Kaloyan K. Tsvetkov Broken Images
  • High 7.1
    CVE-2024-32082

    WordPress Sync Post With Other Site plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Kamlesh Parmar Sync Post With Other Site sync-post-with-other-site allows Cross Site Request Forgery.This issue affects Sync Post With Other Site: from n/a through <= 1.9.1.

    Kamlesh Parmar Sync Post With Other Site
  • High 7.1
    CVE-2024-31285

    WordPress WordPress Tooltips plugin <= 9.5.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tooltip WordPress Tooltips allows Stored XSS.This issue affects WordPress Tooltips: from n/a through 9.5.3.

    Tooltip WordPress Tooltips Web / CMS
  • High 8.8
    CVE-2024-25572

    Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views…

    Saturday Drive Ninja Forms
  • High 8.8
    CVE-2024-2196

    CSRF Vulnerability in aimhubio/aim

    aimhubio/aim is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF…

    aimhubio aimhubio/aim aim PyPI
  • High 7.1
    CVE-2024-31299

    WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Cross Site Request Forgery (CSRF) to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Reservation Diary ReDi Restaurant Reservation allows Cross-Site Scripting (XSS).This issue affects ReDi Restaurant Reservation: from n/a through 24.0128.

    Reservation Diary ReDi Restaurant Reservation
  • High 8.8
    CVE-2024-27474 Public exploit

    Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perfor…

  • High 8.8
    CVE-2024-1315

    Classified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account

    The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing or incorrect nonce validation on the 'rtcl_update_user_acc…

    techlabpro1 Classified Listing – AI-Powered Classified ads & Business Directory Plugin Web / CMS
  • High 8.8
    CVE-2024-2115

    LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation

    The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due to missing or incorrect nonce validation on the filter_users functions. This makes it possible for …

    ThimPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses Web / CMS
  • High 8.8
    CVE-2024-29192

    GHSL-2023-206 gotortc Cross-Site Request Forgery vulnerability

    gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The `/api/config` endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to…

    AlexxIT go2rtc github.com/AlexxIT/go2rtc Go
  • High 7.5
    CVE-2024-20281

    A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted service…

    Cisco Cisco Data Center Network Manager Cisco Nexus Dashboard Cisco Nexus Dashboard Insights Network devices
  • High 7.1
    CVE-2024-31105

    WordPress Tax Rate Upload plugin <= 2.4.5 - CSRF leading to Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5.

    Adam Bowen Tax Rate Upload
  • High 7.1
    CVE-2024-31109

    WordPress Woocommerce Social Media Share Buttons plugin <= 1.3.0 - CSRF to Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Toastie Studio Woocommerce Social Media Share Buttons allows Stored XSS.This issue affects Woocommerce Social Media Share Buttons: from n/a through 1.3.0.

    Toastie Studio Woocommerce Social Media Share Buttons Web / CMS
  • High 8.8
    CVE-2024-30965

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.ph…

  • High 8.8
    CVE-2024-1522

    Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui

    A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate requ…

    parisneo parisneo/lollms-webui
  • High 8.1
    CVE-2024-28233

    XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing

    JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could…

    jupyterhub jupyterhub jupyterhub jupyterhub Debian Ubuntu PyPI
  • High 7.1
    CVE-2023-39311

    WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.

    ThemeFusion Fusion Builder
  • High 7.1
    CVE-2024-29773

    WordPress BizPrint plugin <= 4.5.5 - CSRF to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint allows Cross-Site Scripting (XSS).This issue affects BizPrint: from n/a through 4.5.5.

    BizSwoop a CPF Concepts, LLC Brand BizPrint
  • High 7.5
    CVE-2024-2449 EPSS 13%

    LoadMaster Cross-Site Request Forgery (CSRF)

    A cross-site request forgery vulnerability has been identified in LoadMaster.  It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party s…

    Progress Software LoadMaster
  • High 7.4
    CVE-2024-29499

    Cross-Site Request Forgery in Anchor CMS

    Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2.

    anchorcms/anchor-cms Packagist
  • High 8.3
    CVE-2024-25808

    Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary c…

  • High 7.1
    CVE-2024-27968

    WordPress Super Page Cache for Cloudflare plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.This issue affects Super Page Cache for Cloudflare: from n/a through 4.7.5.

    Optimole Super Page Cache for Cloudflare
  • High 8.1
    CVE-2024-29019

    ESPHome vulnerable to Authentication bypass via Cross site request forgery

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attacke…

    esphome esphome esphome PyPI
  • High 7.1
    CVE-2024-2741

    Cross-Site Request Forgery in Planet IGS-4215-16T2S

    Cross-Site Request Forgery (CSRF) vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to trick some authenticated users into performing actions in their session, such as adding or u…

    PLANET Technology IGS-4215-16T2S
  • High 8.8
    CVE-2024-1538 EPSS 11%

    File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion

    The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. T…

    mndpsingh287 File Manager Web / CMS
  • High 8.2
    CVE-2024-29026

    Owncast cross origin request

    Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to le…

    owncast owncast github.com/owncast/owncast Go
  • High 8.1
    CVE-2024-24336

    A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ end…

  • High 7.1
    CVE-2024-27194

    WordPress Fontific plugin <= 0.1.6 - CSRF to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Andrei Ivasiuc Fontific | Google Fonts allows Stored XSS.This issue affects Fontific | Google Fonts: from n/a through 0.1.6.

    Andrei Ivasiuc Fontific | Google Fonts
  • High 7.1
    CVE-2024-27195

    WordPress Watermark RELOADED plugin <= 1.3.5 - CSRF to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sverde1 Watermark RELOADED watermark-reloaded allows Cross Site Request Forgery.This issue affects Watermark RELOADED: from n/a through <= 1.3.5.

    sverde1 Watermark RELOADED
  • High 7.1
    CVE-2024-27197

    WordPress BeePress plugin <= 6.9.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Bee BeePress allows Stored XSS.This issue affects BeePress: from n/a through 6.9.8.

    Bee BeePress
  • High 8.8
    CVE-2023-51474

    WordPress TerraClassifieds plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelemu TerraClassifieds.This issue affects TerraClassifieds: from n/a through 2.0.3.

    Pixelemu TerraClassifieds
  • High 8.1
    CVE-2024-28195

    Cross-Site Request Forgery (CSRF) vulnerability in API and login in your_spotify

    your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery (CSRF). Attackers can use this to execute CSRF attacks on victims, allowing them to r…

    Yooooomi your_spotify
  • High 8.8
    CVE-2024-28665

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/articl…

  • High 8.8
    CVE-2024-28431

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalo…

  • High 8.8
    CVE-2024-28675

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php

  • High 8.8
    CVE-2024-28684

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module…