Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

4,167 results · Clear filters · Feed

  • Medium 4.3
    CVE-2022-47134

    WordPress Gallery Metabox Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.

    Bill Erickson Gallery Metabox
  • Medium 4.3
    CVE-2023-32589

    WordPress Dyslexiefont Free Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PingOnline Dyslexiefont Free plugin <= 1.0.0 versions.

    PingOnline Dyslexiefont Free
  • Medium 5.4
    CVE-2023-22689

    WordPress Auto Affiliate Links Plugin <= 6.3 is vulnerable to Broken Access Control

    Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.

    Lucian Apostol Auto Affiliate Links
  • Medium 4.3
    CVE-2023-24414

    WordPress Robo Gallery Plugin <= 3.2.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.

    Robosoft Photo Gallery, Images, Slider in Rbs Image Gallery
  • Medium 5.4
    CVE-2023-2717

    Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins

    The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation on the 'enable_safe_mode' function. This makes it possible for unauthenticated attackers to enab…

    trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation Web / CMS
  • Medium 5.4
    CVE-2023-25698

    WordPress Shoppable Images Lite Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.

    Studio Wombat Shoppable Images
  • Medium 5.4
    CVE-2023-27430

    WordPress Mass Delete Unused Tags Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Mass Delete Unused Tags plugin <= 2.0.0 versions.

    ramon fincken Mass Delete Unused Tags
  • Medium 5.4
    CVE-2023-27423

    WordPress Auto Prune Posts Plugin <= 1.8.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Auto Prune Posts plugin <= 1.8.0 versions.

    ramon fincken Auto Prune Posts
  • Medium 5.4
    CVE-2023-2528

    Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action

    The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticate…

    supsysticcom Contact Form by Supsystic Web / CMS
  • Medium 4.3
    CVE-2023-2631

    CSRF vulnerability and missing permission checks in Code Dx Plugin

    A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

    Jenkins Project Jenkins Code Dx Plugin org.jenkins-ci.plugins:codedx Web / CMS Maven
  • Medium 4.3
    CVE-2023-2195

    CSRF vulnerability and missing permission checks in Code Dx Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL.

    Jenkins Project Jenkins Code Dx Plugin org.jenkins-ci.plugins:codedx Web / CMS Maven
  • Medium 5.4
    CVE-2023-33006

    Jenkins WSO2 Oauth Plugin cross-site request forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker's account.

    Jenkins Project Jenkins WSO2 Oauth Plugin org.jenkins-ci.plugins:wso2id-oauth Web / CMS Maven
  • Medium 4.3
    CVE-2023-33003

    Jenkins Tag Profiler Plugin vulnerable to Cross-Site Request Forgery

    A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics.

    Jenkins Project Jenkins Tag Profiler Plugin org.jenkins-ci.plugins:tag-profiler Web / CMS Maven
  • Medium 4.3
    CVE-2023-32980

    Jenkins Email Extension Plugin Cross-Site Request Forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.

    Jenkins Project Jenkins Email Extension Plugin org.jenkins-ci.plugins:email-ext Web / CMS Maven
  • Medium 4.3
    CVE-2023-32978

    Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery

    A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.

    Jenkins Project Jenkins LDAP Plugin org.jenkins-ci.plugins:ldap Web / CMS Maven
  • Medium 6.5
    CVE-2023-28361

    A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to ac…

  • Medium 5.4
    CVE-2022-45846

    WordPress Image Map Pro Plugin < 5.6.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.

    Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder Web / CMS
  • Medium 6.5
    CVE-2023-0522

    Enable/Disable Auto Login when Register <= 1.1.0 - Settings Update via CSRF

    The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

    Web / CMS
  • Medium 6.5
    CVE-2020-22334

    Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via …

  • Medium 4.3
    CVE-2023-25967

    WordPress Community by PeepSo Plugin <= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.

    PeepSo Community by PeepSo
  • Medium 4.3
    CVE-2023-22691

    WordPress Category Specific RSS feed Subscription Plugin <= v2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.

    Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription
  • Medium 4.3
    CVE-2023-2474

    Rebuild cross-site request forgery

    A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and …

  • Medium 4.7
    CVE-2023-2307

    Cross-Site Request Forgery (CSRF) in builderio/qwik

    Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.

    BuilderIO builderio/qwik @builder.io/qwik-city npm
  • Medium 6.5
    CVE-2023-26841

    A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password ex…

  • Medium 4.3
    CVE-2023-26839

    A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing…

  • Medium 5.3
    CVE-2023-26840

    A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and se…

  • Medium 6.4
    CVE-2022-40724

    Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.

    The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

    Ping Identity PingFederate
  • Medium 5.4
    CVE-2023-22686

    WordPress Nice PayPal Button Lite Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.

    TriniTronic Nice PayPal Button Lite
  • Medium 4.3
    CVE-2023-23879

    WordPress PHP Execution Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.

    Nicolas Zeh PHP Execution
  • Medium 5.4
    CVE-2022-45080

    WordPress Add Multiple Marker Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.

    krishaweb Add Multiple Marker
  • Medium 4.3
    CVE-2022-45074

    WordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.

    Paramveer Singh for Arete IT Private Activity Reactions For Buddypress
  • Medium 4.3
    CVE-2022-4944 Public exploit

    kalcaddle KodExplorer cross-site request forgery

    A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The expl…

    kalcaddle KodExplorer
  • Medium 6.5
    CVE-2023-29020

    Cross site request forgery token fixation in fastify-passport

    @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be b…

    fastify fastify-passport @fastify/passport npm
  • Medium 6.8
    CVE-2023-2228

    Cross-Site Request Forgery (CSRF) in modoboa/modoboa

    Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.

    modoboa modoboa/modoboa modoboa PyPI
  • Medium 6.5
    CVE-2023-30616

    Cross Site Request Forgery due to missing nonce verification in form block

    Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing nonce check. There is potential for a Cross Site Request Forgery for all form blocks, since it allows …

    Epiphyt Form Block Web / CMS
  • Medium 5.3
    CVE-2023-27495

    Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection

    @fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under …

    fastify csrf-protection @fastify/csrf-protection npm
  • Medium 4.3
    CVE-2023-30474

    WordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.

    Kilian Evang Ultimate Noindex Nofollow Tool II
  • Medium 4.3
    CVE-2023-30529

    Jenkins Lucene-Search Plugin vulnerable to Cross-Site Request Forgery

    Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.

    Jenkins Project Jenkins Lucene-Search Plugin org.jenkins-ci.plugins:lucene-search Web / CMS Maven
  • Medium 6.5
    CVE-2023-27520

    Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote un…

    Seiko Epson SEIKO EPSON printers/network interface Web Config
  • Medium 4.3
    CVE-2023-25411

    Aten PE8108 2.4.232 is vulnerable to Cross Site Request Forgery (CSRF).