Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Implementation

Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Architecture and Design

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and Design

Use the "double-submitted cookie" method as described by Felten and Zeller:
When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Architecture and Design

Do not use the GET method for any request that triggers a state change.
Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

4,167 results · Clear filters · Feed

Medium 4.3

CVE-2022-4707

Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation

The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated att…

WP Royal Royal Addons for Elementor – Addons and Templates Kit for Elementor Web / CMS

Jan 10, 2023
Medium 5.3

CVE-2023-22472

Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows…

Nextcloud security-advisories nextcloud-client Alpine

Jan 9, 2023
Medium 5.4

CVE-2023-0086

JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update

The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to …

jetmonsters JetWidgets For Elementor Web / CMS

Jan 5, 2023
Medium 4.3

CVE-2022-42435

IBM Business Automation Workflow cross-site request forgery

IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…

IBM Business Automation Workflow

Jan 3, 2023
Medium 4.3

CVE-2014-125028

valtech IDP Test Client main.py cross-site request forgery

A vulnerability was found in valtech IDP Test Client and classified as problematic. Affected by this issue is some unknown functionality of the file python-flask/main.py. The manipulation leads to cross-site request forgery. The attack may be launched remotel…

valtech IDP Test Client

Dec 31, 2022
Medium 6.5

CVE-2022-4850

Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 29, 2022
Medium 6.3

CVE-2022-4846

Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 29, 2022
Medium 6.7

CVE-2022-4845

Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 29, 2022
Medium 6.5

CVE-2022-4844

Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 29, 2022
Medium 4.3

CVE-2022-4766

dolibarr_project_timesheet Form cross-site request forgery

A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated …

Dec 27, 2022
Medium 4.3

CVE-2020-36633

moodle-block_sitenews block_sitenews.php get_content cross-site request forgery

A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack re…

Web / CMS

Dec 27, 2022
Medium 4.3

CVE-2020-36625

destiny.gg chat main.go websocket.Upgrader cross-site request forgery

A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the…

destiny.gg chat github.com/destinygg/chat Go

Dec 22, 2022
Medium 5.3

CVE-2022-4646

Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.

ikus060 ikus060/rdiffweb rdiffweb PyPI

Dec 22, 2022
Medium 6.5

CVE-2022-46491

A Cross-Site Request Forgery (CSRF) vulnerability in the Add Administrator function of the default version of nbnbk all…

Dec 22, 2022
Medium 4.3

CVE-2022-4633

Auto Upload Images Settings setting-page.php cross-site request forgery

A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request fo…

Dec 21, 2022
Medium 4.3

CVE-2022-4604

wp-english-wp-admin Plugin english-wp-admin.php register_endpoints cross-site request forgery

A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the function register_endpoints of the file english-wp-admin.php. The manipulation leads to cross-site request forgery. The attack…

Dec 18, 2022
Medium 4.3

CVE-2022-4564

University of Central Florida Materia API Controller api.php before cross-site request forgery

A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-si…

University of Central Florida Materia

Dec 16, 2022
Medium 6.5

CVE-2022-46059

AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).

Dec 13, 2022
Medium 4.5

CVE-2022-46062

Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).

Dec 13, 2022
Medium 4.3

CVE-2022-41263

Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - version…

SAP Business Objects Business Intelligence Platform (Web intelligence)

Dec 12, 2022
Medium 6.5

CVE-2022-46688

Jenkins Sonar Gerrit Plugin vulnerable to Cross-Site Request Forgery

A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials ID…

Jenkins Project Jenkins Sonar Gerrit Plugin org.jenkins-ci.plugins:sonar-gerrit Web / CMS Maven

Dec 7, 2022
Medium 5.4

CVE-2022-45824

WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.

Advanced Booking Calendar Advanced Booking Calendar

Dec 5, 2022
Medium 4.3

CVE-2022-35730

WordPress Oceanwp sticky header plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress.

Oren Hahiashvili Oceanwp sticky header

Dec 4, 2022
Medium —

GHSA-47xh-qxqv-mgvg

kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF)

### Impact > A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing …

github.com/mittwald/kube-httpcache Go

Dec 2, 2022
Medium 5.4

CVE-2022-4220

Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to dele…

prasunsen Chained Quiz Web / CMS

Dec 2, 2022
Medium 5.4

CVE-2022-4219

Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible for unauthenticated attackers to delete submi…

prasunsen Chained Quiz Web / CMS

Dec 2, 2022
Medium 5.4

CVE-2022-4218

Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated attackers to delete…

prasunsen Chained Quiz Web / CMS

Dec 2, 2022
Medium 6.5

CVE-2022-45667

Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.

Dec 2, 2022
Medium 6.5

CVE-2022-45673

Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.

Dec 2, 2022
Medium 6.5

CVE-2022-45674

Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

Dec 2, 2022
Medium 6.5

CVE-2022-45668

Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

Dec 2, 2022
Medium 4.3

CVE-2022-41297

IBM Db2U cross-site request forgery

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212.

IBM Db2U

Dec 1, 2022
Medium 6.5

CVE-2022-41296

IBM Db2U cross-site respect forgery

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210.

IBM Db2U

Dec 1, 2022
Medium 5.4

CVE-2022-26366

WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.

Arnan de Gans AdRotate Banner Manager (WordPress plugin) Web / CMS

Nov 30, 2022
Medium 4.3

CVE-2022-41413 Public exploit

perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attac…

Nov 30, 2022
Medium 4.3

CVE-2022-34654

WordPress Manage Notification E-mails Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.

Virgial Berveling Manage Notification E-mails (WordPress plugin) Web / CMS

Nov 28, 2022
Medium 6.5

CVE-2022-44937

Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrat…

Nov 28, 2022
Medium 4.3

CVE-2020-23588 Public exploit

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

Nov 23, 2022
Medium 4.3

CVE-2020-23586 Public exploit

A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an una…

Nov 23, 2022
Medium 6.5

CVE-2020-23589 Public exploit

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

Nov 23, 2022