Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,780 results · Feed

  • Medium 5.4
    CVE-2023-49744

    WordPress Gift Up Gift Cards for WordPress and WooCommerce Plugin <= 2.21.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gift Up Gift Up Gift Cards for WordPress and WooCommerce.This issue affects Gift Up Gift Cards for WordPress and WooCommerce: from n/a through 2.21.3.

    Gift Up! Gift Up Gift Cards for WordPress and WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-49197

    WordPress DoFollow Case by Case Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Apasionados, Apasionados del Marketing, NetConsulting DoFollow Case by Case.This issue affects DoFollow Case by Case: from n/a through 3.4.2.

    Apasionados, Apasionados del Marketing, NetConsulting DoFollow Case by Case
  • Medium 4.3
    CVE-2023-50870

    In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible

    JetBrains TeamCity
  • Medium 4.3
    CVE-2023-6766

    PHPGurukul Teacher Subject Allocation Management System Delete Course course.php cross-site request forgery

    A vulnerability classified as problematic has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the file /admin/course.php of the component Delete Course Handler. The manipulation of the argument del…

    PHPGurukul Teacher Subject Allocation Management System
  • Medium 4.3
    CVE-2023-50778

    Cross-Site Request Forgery in Jenkins PaaSLane Estimate Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified token.

    Jenkins Project Jenkins PaaSLane Estimate Plugin com.cloudtp.jenkins:paaslane-estimate Web / CMS Maven
  • Medium 4.3
    CVE-2023-50775

    Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs.

    Jenkins Project Jenkins Deployment Dashboard Plugin org.jenkins-ci.plugins:ec2-deployment-dashboard Web / CMS Maven
  • High 8.1
    CVE-2023-50774

    Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.

    Jenkins Project Jenkins HTMLResource Plugin org.jenkins-ci.plugins:htmlresource Web / CMS Maven
  • High 8.8
    CVE-2023-50768

    Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing crede…

    Jenkins Project Jenkins Nexus Platform Plugin org.sonatype.nexus.ci:nexus-jenkins-plugin Web / CMS Maven
  • High 8.8
    CVE-2023-50766

    Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.

    Jenkins Project Jenkins Nexus Platform Plugin org.sonatype.nexus.ci:nexus-jenkins-plugin Web / CMS Maven
  • High 7.5
    CVE-2022-27488

    A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 th…

    Fortinet FortiMail FortiVoice FortiRecorder Network devices
  • High 8.8
    CVE-2023-47322

    Cross Site Request Forgery in Silverpeas

    The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute ma…

    org.silverpeas.core:silverpeas-core-web Maven
  • High 8.8
    CVE-2023-47578

    Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices are susceptible to Cross Site Request Forgery (CSRF) attacks due to…

  • High 8.8
    CVE-2023-47326

    Cross Site Request Forgery in Silverpeas

    Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function.

    org.silverpeas.core:silverpeas-core Maven
  • High 7.3
    CVE-2023-45316

    Reflected client side path traversal leading to CSRF in Playbooks

    Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.

    Mattermost Mattermost
  • Medium 6.3
    CVE-2023-6671

    Cross-Site Request Forgery on OPEN JOURNAL SYSTEMS

    A vulnerability has been discovered on OJS, that consists in a CSRF (Cross-Site Request Forgery) attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.

    OPEN JOURNAL SYSTEMS OPEN JOURNAL SYSTEMS
  • Medium 4.3
    CVE-2023-6653

    PHPGurukul Teacher Subject Allocation Management System Create a new Subject subject.php cross-site request forgery

    A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/subject.php of the component Create a new Subject. The manipula…

    PHPGurukul Teacher Subject Allocation Management System
  • Medium 5.4
    CVE-2023-5756

    Digital Publications by Supsystic <= 1.7.6 - Cross-Site Request Forgery via AJAX action

    The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthe…

    supsysticcom WordPress Flipbook by Supsystic Web / CMS
  • High 8.8
    CVE-2023-49378

    Cross-Site Request Forgery in JFinalCMS via /admin/form/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49374

    Cross-Site Request Forgery in JFinalCMS via /admin/slide/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49382

    Cross-Site Request Forgery in JFinalCMS via /admin/div/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49397

    Cross-Site Request Forgery in JFinalCMS via /admin/category/updateStatus

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49372

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49396

    Cross-Site Request Forgery in JFinalCMS via /admin/category/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49447

    Cross-Site Request Forgery in JFinalCMS via /admin/nav/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49446

    Cross-Site Request Forgery in JFinalCMS via /admin/nav/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49380

    Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49398

    Cross-Site Request Forgery in JFinalCMS via /admin/category/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49448

    Cross-Site Request Forgery in JFinalCMS via admin/nav/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49383

    Cross-Site Request Forgery in JFinalCMS via /admin/tag/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49379

    Cross-Site Request Forgery in JFinalCMS via the component /admin/friend_link/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49375

    Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49395

    Cross-Site Request Forgery in JFinalCMS via /admin/category/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49381

    Cross-Site Request Forgery in JFinalCMS via /admin/div/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49376

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49377

    Cross-Site Request Forgery in JFinalCMS via /admin/tag/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49373

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-24048

    Cross Site Request Forgery (CSRF) vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain contro…

  • Medium 4.3
    CVE-2023-6474

    PHPGurukul Nipah Virus Testing Management System manage-phlebotomist.php cross-site request forgery

    A vulnerability has been found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file manage-phlebotomist.php. The manipulation of the argument pid leads to cross-site request…

    PHPGurukul Nipah Virus Testing Management System
  • Medium 4.3
    CVE-2023-38268

    IBM InfoSphere Information Server cross-site request forgery

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 260585.

    IBM InfoSphere Information Server
  • High 7.1
    CVE-2023-47870

    WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpFo…

    gVectors Team wpForo Forum