Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

4,167 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-2352

    CHP Ads Block Detector <= 3.9.4 - Cross-Site Request Forgery via chp_abd_action

    The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is due to missing or incorrect nonce validation on the chp_abd_action function. This makes it possible for unauthenticate…

    sureshchand12a CHP Ads Block Detector Web / CMS
  • Medium 5.4
    CVE-2023-2279

    WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display

    The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'admin_page_display' function. This makes it possible for unauthenticate…

    Wp Directory Kit WP Directory Kit Web / CMS
  • Medium 6.3
    CVE-2023-4000

    Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgery

    The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated at…

    pluginbuilders Waiting: One-click countdowns Web / CMS
  • Medium 4.3
    CVE-2023-4161

    WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation

    The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create…

    Edgar Rojas PDF Builder for WooCommerce. Create invoices,packing slips and more Web / CMS
  • Medium 5.3
    CVE-2023-23473

    IBM InfoSphere Information Server cross-site request forgery

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 245400.

    IBM InfoSphere Information Server
  • Medium 4.2
    CVE-2023-4301

    CSRF vulnerability in Fortify Plugin allow capturing credentials

    A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in …

    Jenkins Project Jenkins Fortify Plugin org.jenkins-ci.plugins:fortify Web / CMS Maven
  • Medium 6.5
    CVE-2023-4455

    Cross-Site Request Forgery (CSRF) in wallabag/wallabag

    Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 4.3
    CVE-2023-4454

    Cross-Site Request Forgery (CSRF) in wallabag/wallabag

    Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 6.5
    CVE-2023-40172

    Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton

    Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on…

    fobybus social-media-skeleton
  • Medium 6.5
    CVE-2023-20221

    A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform …

    Cisco Cisco IP Phones with Multiplatform Firmware Cisco PhoneOS Network devices
  • Medium 4.3
    CVE-2023-40351

    Jenkins Favorite View Plugin cross-site request forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or remove views from another user's favorite views tab bar.

    Jenkins Project Jenkins Favorite View Plugin org.jenkins-ci.plugins:favorite-view Web / CMS Maven
  • Medium 5.4
    CVE-2023-40341

    Jenkins Blue Ocean Plugin cross-site request forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.

    Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean Web / CMS Maven
  • Medium 4.3
    CVE-2023-40337

    Jenkins Folders Plugin cross-site request forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.

    Jenkins Project Jenkins Folders Plugin org.jenkins-ci.plugins:cloudbees-folder Web / CMS Maven
  • Medium 4.3
    CVE-2023-3977

    Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

    Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various ver…

    Inisev Migrate cl272 s-feeds
  • Medium 5.4
    CVE-2023-38512

    WordPress WpStream plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream wpstream allows Cross Site Request Forgery.This issue affects WpStream: from n/a through <= 4.5.4.

    wpstream WpStream
  • Medium 6.1
    CVE-2023-3414

    Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps

    A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 ver…

    ServiceNow Jenkins plug-in for ServiceNow DevOps io.jenkins.plugins:servicenow-devops Web / CMS Maven
  • Medium 4.3
    CVE-2023-39156

    CSRF vulnerability in Bazaar Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.

    Jenkins Project Jenkins Bazaar Plugin org.jenkins-ci.plugins:bazaar Web / CMS Maven
  • Medium 5.4
    CVE-2023-39153

    CSRF vulnerability in GitLab Authentication Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.

    Jenkins Project Jenkins Gitlab Authentication Plugin org.jenkins-ci.plugins:gitlab-oauth Web / CMS Maven
  • Medium 4.3
    CVE-2023-3841

    NxFilter user.jsp cross-site request forgery

    A vulnerability has been found in NxFilter 4.3.2.5 and classified as problematic. This vulnerability affects unknown code of the file user.jsp. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The identifier of this …

  • Medium 4.3
    CVE-2023-37892

    WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions.

    Kemal YAZICI - PluginPress Shortcode IMDB
  • Medium 5.4
    CVE-2023-37973

    WordPress Replace Word Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <= 2.1 versions.

    David Pokorny Replace Word
  • Medium 4.3
    CVE-2023-37889

    WordPress WPAdmin AWS CDN Plugin <= 2.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.

    WPAdmin WPAdmin AWS CDN
  • Medium 4.3
    CVE-2023-25036

    WordPress Social Media Icons Widget Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.

    akhlesh-nagar, a.ankit Social Media Icons Widget
  • Medium 5.4
    CVE-2023-37387

    WordPress Classified Listing Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.

    RadiusTheme Classified Listing
  • Medium 4.3
    CVE-2022-47169

    WordPress Visibility Logic for Elementor Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StaxWP Visibility Logic for Elementor plugin <= 2.3.4 versions.

    StaxWP Visibility Logic for Elementor
  • Medium 5.4
    CVE-2023-37386

    WordPress Media Library Helper by Codexin Plugin <= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.

  • Medium 4.3
    CVE-2023-25475

    WordPress Smart YouTube PRO Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Smart YouTube PRO plugin <= 4.3 versions.

    Vladimir Prelovac Smart YouTube PRO
  • Medium 4.3
    CVE-2022-45828

    WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.

    NooTheme Noo Timetable
  • Medium 5.4
    CVE-2022-46857

    WordPress SiteAlert (Formerly WP Health) Plugin <= 1.9.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in SiteAlert plugin <= 1.9.7 versions.

    sitealert SiteAlert
  • Medium 5.4
    CVE-2023-25473

    WordPress Flickr Justified Gallery Plugin <= 3.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions.

    miro.mannino Flickr Justified Gallery
  • Medium 4.3
    CVE-2023-25482

    WordPress WP Tiles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <= 1.1.2 versions.

    Mike Martel WP Tiles
  • Medium 4.3
    CVE-2022-38062

    WordPress Download Theme Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <= 1.0.9 versions.

    Metagauss Download Theme
  • Medium 4.3
    CVE-2022-36424

    WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions.

    Nikola Loncar Easy Appointments
  • Medium 4.3
    CVE-2023-37985

    WordPress Five Star Restaurant Menu Plugin <= 2.4.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in FiveStarPlugins Restaurant Menu and Food Ordering plugin <= 2.4.6 versions.

    Five Star Plugins Restaurant Menu and Food Ordering by Five Star Plugins
  • Medium 5.4
    CVE-2023-37974

    WordPress WP-FB-AutoConnect Plugin <= 4.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Justin Klein WP Social AutoConnect plugin <= 4.6.1 versions.

    Justin Klein WP Social AutoConnect
  • Medium 5.4
    CVE-2023-37968

    WordPress Falang multilanguage Plugin <= 1.3.39 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions.

    Faboba Falang multilanguage for WordPress Web / CMS
  • Medium 6.5
    CVE-2023-34005

    WordPress Front End Users Plugin <= 3.2.24 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <= 3.2.24 versions.

    Etoile Web Design Front End Users
  • Medium 4.3
    CVE-2022-47172

    WordPress WooLentor Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions.

    HasThemes ShopLentor
  • Medium 6.5
    CVE-2023-36514

    WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.

    woocommerce Shipping Multiple Addresses
  • Medium 5.4
    CVE-2023-36513

    WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions.

    woocommerce AutomateWoo