Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

4,167 results · Clear filters · Feed

  • Medium 5.4
    CVE-2017-2613

    Cross-Site Request Forgery in Jenkins

    jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (S…

    [UNKNOWN] jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Medium 6.5
    CVE-2018-5301

    Magento Cross-Site Request Forgery (CSRF)

    Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.

    magento/community-edition Packagist
  • Medium —
    CVE-2017-12631

    Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3

    Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.…

    Apache Software Foundation Apache CXF Fediz org.apache.cxf.fediz:fediz-spring2 org.apache.cxf.fediz:fediz-spring Maven
  • Medium 6.5
    CVE-2017-1000085

    Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability

    Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to conn…

    subversion org.jenkins-ci.plugins:subversion Azure Linux Maven
  • Medium 6.3
    CVE-2017-1000091

    Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery

    GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with…

    org.jenkins-ci.plugins:github-branch-source Maven
  • Medium 6.5
    CVE-2017-7620 Public exploit

    MantisBT vulnerable to CSRF and Open Redirect attacks

    MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to …

    mantisbt/mantisbt Packagist
  • Medium —
    CVE-2017-7661

    Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2

    Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz pri…

    Apache Software Foundation Apache CXF Fediz org.apache.cxf.fediz:fediz-spring2 org.apache.cxf.fediz:fediz-jetty9 Maven
  • Medium 4.5
    CVE-2017-8382 Public exploit

    admidio CSRF Vulnerability

    admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.

    admidio/admidio Packagist
  • Medium 4.3
    CVE-2017-7491

    Moodle Cross-Site Request Forgery (CSRF)

    In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.5
    CVE-2016-4808 Public exploit

    Web2py Cross-Site Request Forgery vulnerability

    Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just…

    web2py PyPI
  • Medium 4.3
    CVE-2015-5335

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests th…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-0218

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that tri…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-0213

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack th…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-1585

    Fat Free CRM Cross-Site Request Forgery vulnerability

    Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.

    fat_free_crm RubyGems
  • Medium —
    CVE-2014-8144

    Doorkeeper vulnerable to Cross-site Request Forgery

    Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

    doorkeeper RubyGems
  • Medium —
    CVE-2014-7809

    Cross-Site Request Forgery in Apache Struts

    Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.

    org.apache.struts:struts2-core Maven
  • Medium —
    CVE-2014-7838

    Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that se…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7836

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/requ…

    moodle/moodle Packagist
  • Medium 5.3
    CVE-2012-5500

    Plone contains Cross-site Request Forgery

    The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

    plone PyPI
  • Medium 4.3
    CVE-2014-2358

    Fox-IT DataDiode Appliance CSRF

    Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative web interface in the proxy server on Fox-IT Fox DataDiode appliances before 1.7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) crea…

    Fox-IT DataDiode Appliance
  • Medium —
    CVE-2014-0168

    Cross-Site Request Forgery in Jolokia

    Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

    org.jolokia:jolokia-core Maven
  • Medium 4.6
    CVE-2014-2369

    Omron NS Series HMI Cross-Site Request Forgery

    Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

    Omron NS12 NS8 NS15 ICS / OT
  • Medium —
    CVE-2014-4671 Public exploit EPSS 22%

    Rosetta-Flash JSONP Vulnerability in hapi

    Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restr…

    flashplugin-nonfree hapi Ubuntu npm
  • Medium —
    CVE-2014-0213

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of …

    moodle/moodle Packagist
  • Medium —
    CVE-2013-2034

    Jenkins Cross-Site Request Forgery vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests th…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-4562

    omniauth-facebook Cross-Site Request Forgery vulnerability

    The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

    omniauth-facebook RubyGems
  • Medium —
    CVE-2014-0054 EPSS 91%

    Cross-Site Request Forgery in Spring Framework

    The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF atta…

    libspring-java org.springframework:spring-webmvc Debian Maven
  • Medium —
    CVE-2014-0126

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests t…

    moodle/moodle Packagist
  • Medium —
    CVE-2013-6429 EPSS 91%

    Cross-Site Request Forgery in Spring Framework

    The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attack…

    libspring-java org.springframework:spring-web Debian Maven
  • Medium —
    CVE-2013-4152 EPSS 26%

    Cross-Site Request Forgery in Spring Framework

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Medium —
    CVE-2013-7223

    Fat Free CRM contains Cross-site Request Forgery vulnerablilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/appl…

    fat_free_crm RubyGems
  • Medium —
    CVE-2012-6134

    omniauth-oauth2 Cross-Site Request Forgery vulnerability

    Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

    omniauth-oauth2 RubyGems
  • Medium —
    CVE-2013-0329

    Jenkins Cross-Site Request Forgery vulnerability

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0327

    Jenkins Cross-Site Request Forgery vulnerability

    Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2012-4431 Public exploit

    Cross-Site Request Forgery in Apache Tomcat

    org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-4386

    Cross-Site Request Forgery in Apache Struts

    The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parame…

    org.apache.struts:struts2-core Maven
  • Medium —
    CVE-2011-4281

    Moodle vulnerable to Cross-Site Request Forgery

    Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.

    moodle/moodle Packagist
  • Medium —
    CVE-2011-4133

    Moodle vulnerable to Cross-Site Request Forgery

    Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.

    moodle/moodle Packagist
  • Medium —
    CVE-2011-4298

    Moodle vulnerable to Cross-Site Request Forgery

    Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.

    moodle/moodle Packagist
  • Medium —
    CVE-2011-0447

    actionpack Cross-Site Request Forgery vulnerability

    Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via fo…

    rails actionpack Debian RubyGems