Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

4,167 results · Clear filters · Feed

  • Medium 6.5
    CVE-2020-23593 Public exploit

    A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenti…

  • Medium 6.5
    CVE-2020-23590 Public exploit

    A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

  • Medium 5.4
    CVE-2022-45149

    Cross-Site Request Forgery in Moodle

    A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote at…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2022-44737

    WordPress All In One WP Security plugin <= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.

    All In One WP Security & Firewall Team All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) Web / CMS
  • Medium 4.2
    CVE-2022-41919

    Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type

    Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", …

    fastify fastify fastify npm
  • Medium 6.5
    CVE-2020-23582 Public exploit

    A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, …

  • Medium 6.1
    CVE-2022-41615

    WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

    Agile Logix Store Locator WordPress (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-41634

    WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

    Max Foundry Media Library Folders (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-41685

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

    Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez (WordPress plugin) Integration for Szamlazz.hu & WooCommerce (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-40695

    WordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities

    Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.

    wp-buy SEO Redirection Plugin – 301 Redirect Manager (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-44740

    WordPress Creative Mail plugin <= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.

    Constant Contact Creative Mail (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-45073

    WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

    miniOrange WordPress REST API Authentication (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-38075

    WordPress Mantenimiento web plugin <= 0.13 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

    Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.

    Carlos Doral Mantenimiento web (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-40687

    WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

    Constant Contact Creative Mail (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-41805

    WordPress Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.

    Pluggabl Booster for WooCommerce (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-40686

    WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

    Constant Contact Creative Mail (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-45071

    WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

    OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-45072

    WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

    OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-4014

    FeehiCMS Post My Comment Tab cross-site request forgery

    A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My Comment Tab. The manipulation leads to cross-site request forgery. The attack may be launched remot…

    feehi/feehicms Packagist
  • Medium 4.3
    CVE-2022-45398

    Cross-Site Request Forgery in Jenkins Cluster Statistics Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.

    Jenkins Project Jenkins Cluster Statistics Plugin org.zeroturnaround:cluster-stats Web / CMS Maven
  • Medium 6.5
    CVE-2022-3632

    OAuth Client by DigitialPixies <= 1.1.0 - CSRF

    The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.

    Web / CMS
  • Medium 6.5
    CVE-2022-3538

    Webmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation

    The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins

    Web / CMS
  • Medium 6.5
    CVE-2022-2449

    reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF

    The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.

    Web / CMS
  • Medium 6.5
    CVE-2022-44389

    EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module…

  • Medium 4.3
    CVE-2022-3978

    NodeBB abort cross-site request forgery

    A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to…

    nodebb npm
  • Medium 6.5
    CVE-2022-45130

    Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obs…

  • Medium 5.4
    CVE-2022-43488

    WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.

    Algolplus Advanced Dynamic Pricing for WooCommerce (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-32587

    WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.

    CodeAndMore WP Page Widget (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-44741

    WordPress Testimonial Slider plugin <= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.

    David Anderson Testimonial Slider (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-38137

    WordPress Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.

    Analytify Analytify (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-27855

    WordPress Analytics Cat plugin <= 1.0.9 - Plugin Settings change via Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change.

    Fatcat Apps Analytics Cat (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-41136

    WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS

    Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

    Vladimir Anokhin Shortcodes Ultimate (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-40632

    WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.

    gVectors Team wpForo Forum (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-40128

    WordPress Advanced Order Export For WooCommerce plugin <= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.

    Algolplus Advanced Order Export For WooCommerce (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-43481

    WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.

    Rymera Web Co Advanced Coupons (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-43491

    WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.

    Algolplus Advanced Dynamic Pricing for WooCommerce (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2022-30694

    The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenti…

    Siemens SIMATIC S7-1500 CPU 1512C-1 PN SIMATIC Drive Controller CPU 1504D TF SIMATIC S7-1500 CPU 1513F-1 PN ICS / OT
  • Medium 5.3
    CVE-2022-3489

    WP Hide <= 0.0.2 - Unauthenticated Settings Update

    The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request

    Web / CMS
  • Medium 4.3
    CVE-2022-3451

    Product Stock Manager < 1.0.5 - Subscriber+ Unauthorised AJAX Calls

    The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options

    Web / CMS
  • Medium 4.3
    CVE-2022-2387

    Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF

    The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete a…

    Web / CMS