Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

4,167 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-2748

    CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user

    A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an unsuspecting user. A mitigating factor is that user interaction is required. This vulnerability affe…

    GitHub Enterprise Server
  • Medium 4.3
    CVE-2024-1325

    Live Sales Notification for Woocommerce – Woomotiv <= 3.4.3 - Cross-Site Request Forgery via ajax_cancel_review

    The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.3. This is due to missing or incorrect nonce validation on the 'ajax_cancel_review' function. Thi…

    delabon Live Sales Notification for Woocommerce – Woomotiv Web / CMS
  • Medium 5.4
    CVE-2024-1785

    Contests by Rewards Fuel <= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthe…

    rewardsfuel Contests by Rewards Fuel Web / CMS
  • Medium 4.3
    CVE-2024-29093

    WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <=…

    Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort Web / CMS
  • Medium 6.5
    CVE-2024-27439

    Apache Wicket: Possible bypass of CSRF protection

    An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not supp…

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket Maven
  • Medium 6.1
    CVE-2024-22475

    Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provide…

    Toshiba Tec Ricoh Company BROTHER INDUSTRIES Fujifilm Business Innovation
  • Medium 6.3
    CVE-2024-27974

    Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet …

    FUJIFILM Business Inovation DocuPrint C3350 ApeosPort-IV C2270 R DocuPrint P450 ps
  • Medium 4.3
    CVE-2024-2560

    Tenda AC18 SysToolRestoreSet fromSysToolRestoreSet cross-site request forgery

    A vulnerability classified as problematic was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack can be …

    Tenda AC18
  • Medium 4.3
    CVE-2024-2559

    Tenda AC18 SysToolReboot fromSysToolReboot cross-site request forgery

    A vulnerability classified as problematic has been found in Tenda AC18 15.03.05.05. Affected is the function fromSysToolReboot of the file /goform/SysToolReboot. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotel…

    Tenda AC18
  • Medium 5.4
    CVE-2023-51486

    WordPress WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.101 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.

    RedNao WooCommerce PDF Invoice Builder Web / CMS
  • Medium 5.4
    CVE-2023-51487

    WordPress ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.2.32 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft ARI Stream Quiz.This issue affects ARI Stream Quiz: from n/a through 1.2.32.

    ARI Soft ARI Stream Quiz
  • Medium 5.4
    CVE-2023-51489

    WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.

    Automattic Crowdsignal Dashboard – Polls, Surveys & more
  • Medium 5.4
    CVE-2023-51491

    WordPress Depicter Slider plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6.

    Averta Depicter Slider
  • Medium 4.3
    CVE-2023-51510

    WordPress Export Media URLs plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0.

    Atlas Gondal Export Media URLs
  • Medium 4.3
    CVE-2023-51512

    WordPress Product Table by WBW plugin <= 1.8.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.This issue affects Product Table by WBW: from n/a through 1.8.6.

    WBW Product Table by WBW
  • Medium 5.4
    CVE-2023-51521

    WordPress Quiz And Survey Master plugin <= 8.1.18 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.

    ExpressTech Systems Quiz And Survey Master
  • Medium 4.3
    CVE-2023-51407

    WordPress Split Test For Elementor plugin <= 1.6.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9.

    Rocket Elements Split Test For Elementor
  • Medium 4.3
    CVE-2023-51522

    WordPress Paid Membership Subscriptions plugin <= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4.

    Cozmoslabs Paid Member Subscriptions
  • Medium 4.3
    CVE-2023-51369

    WordPress Customize My Account for WooCommerce plugin <= 1.8.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in SysBasics Customize My Account for WooCommerce.This issue affects Customize My Account for WooCommerce: from n/a through 1.8.3.

    SysBasics Customize My Account for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-50886

    WordPress Legal Pages plugin <= 1.3.7 - CSRF + Broken Access Control vulnerability

    Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.

    wpWax Legal Pages
  • Medium 4.3
    CVE-2023-51525

    WordPress WP Simple Booking Calendar plugin <= 2.0.8.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a through 2.0.8.4.

    Veribo, Roland Murg WP Simple Booking Calendar
  • Medium 4.3
    CVE-2023-50861

    WordPress HUSKY plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.

    RealMag777 HUSKY – Products Filter for WooCommerce (formerly WOOF) Web / CMS
  • Medium 4.3
    CVE-2024-2483

    Surya2Developer Hostel Management Service Password Change change-password.php cross-site request forgery

    A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects some unknown processing of the file /change-password.php of the component Password Change Handler. The manipulation of th…

    Surya2Developer Hostel Management Service
  • Medium 4.5
    CVE-2024-27265

    IBM Integration Bus for z/OS cross-site request forgery

    IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 284564.

    IBM Integration Bus for z/OS
  • Medium 4.3
    CVE-2024-1489

    SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery

    The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it…

    cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery Web / CMS
  • Medium 4.3
    CVE-2024-0827

    Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Cross-Site Request Forgery

    The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.4. This is due to missing or incorrect nonce validation on several functions. Th…

    hammadh Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio Web / CMS
  • Medium 4.3
    CVE-2024-0830

    Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgery

    The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This makes it possible f…

    N-Media Comments Extra Fields For Post,Pages and CPT Web / CMS
  • Medium 5.4
    CVE-2024-0592

    Related Posts for WordPress <= 2.2.1 - Cross-Site Request Forgery

    The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the handle_create_link() function. This makes it possible for…

    Barry Kooij Related Posts for WordPress Web / CMS
  • Medium 4.3
    CVE-2024-1642

    MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk

    The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bul…

    mainwp MainWP Dashboard: Self-hosted WordPress Management for Agencies Web / CMS
  • Medium 6.5
    CVE-2024-2416

    Cross-Site Request Forgery vulnerability in Movistar 4G router

    Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application in which they are currently authenticated.

    Movistar Router Movistar 4G
  • Medium 6.3
    CVE-2024-28678

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/articl…

  • Medium 6.1
    CVE-2024-28670

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_main.php.

  • Medium 6.1
    CVE-2024-28667

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/temple…

  • Medium 6.1
    CVE-2024-28430

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalo…

  • Medium 5.4
    CVE-2024-28669

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php.

  • Medium 6.1
    CVE-2024-28677

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_mai…

  • Medium 5.5
    CVE-2024-28429

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archiv…

  • Medium 6.3
    CVE-2024-28682

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php.

  • Medium 6.1
    CVE-2024-28681

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php.

  • Medium 5.4
    CVE-2024-28672

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php.