Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,781 results · Feed

  • High 8.8
    CVE-2020-24922

    xuxueli xxl-job Cross-Site Request Forgery Vulnerability

    Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file.

    com.xuxueli:xxl-job Maven
  • High 8.8
    CVE-2023-4276

    Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change

    The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abpr_profileShortcode' function. This makes it possible for unauthenticated attackers …

    johnkolbert Absolute Privacy Web / CMS
  • High 8.8
    CVE-2023-4277

    Realia <= 1.4.0 - Cross-Site Request Forgery to User Email Change

    The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on the 'process_change_profile_form' function. This makes it possible for unauthenticated attackers to…

    pragmaticmates Realia Web / CMS
  • High 8.8
    CVE-2023-38759

    wger Workout Manager Cross-Site Request Forgery vulnerability

    Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset_user_password.html, templates/user/overview.h…

    wger PyPI
  • Unscored —
    CVE-2023-4047

    A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…

    Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2023-3977

    Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

    Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various ver…

    Inisev Migrate cl272 steve85b
  • Medium 5.4
    CVE-2023-38512

    WordPress WpStream plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream wpstream allows Cross Site Request Forgery.This issue affects WpStream: from n/a through <= 4.5.4.

    wpstream WpStream
  • Medium 6.1
    CVE-2023-3414

    Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps

    A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 ver…

    ServiceNow Jenkins plug-in for ServiceNow DevOps io.jenkins.plugins:servicenow-devops Web / CMS Maven
  • Medium 4.3
    CVE-2023-39156

    CSRF vulnerability in Bazaar Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.

    Jenkins Project Jenkins Bazaar Plugin org.jenkins-ci.plugins:bazaar Web / CMS Maven
  • Medium 5.4
    CVE-2023-39153

    CSRF vulnerability in GitLab Authentication Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.

    Jenkins Project Jenkins Gitlab Authentication Plugin org.jenkins-ci.plugins:gitlab-oauth Web / CMS Maven
  • Medium 4.3
    CVE-2023-3841

    NxFilter user.jsp cross-site request forgery

    A vulnerability has been found in NxFilter 4.3.2.5 and classified as problematic. This vulnerability affects unknown code of the file user.jsp. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The identifier of this …

  • High 8.8
    CVE-2023-37650

    Cockpit CMS Cross-Site Request Forgery vulnerability

    A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.

    cockpit-hq/cockpit Packagist
  • Medium 4.3
    CVE-2023-37892

    WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions.

    Kemal YAZICI - PluginPress Shortcode IMDB
  • Medium 5.4
    CVE-2023-37973

    WordPress Replace Word Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <= 2.1 versions.

    David Pokorny Replace Word
  • Medium 4.3
    CVE-2023-37889

    WordPress WPAdmin AWS CDN Plugin <= 2.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.

    WPAdmin WPAdmin AWS CDN
  • Medium 4.3
    CVE-2023-25036

    WordPress Social Media Icons Widget Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.

    akhlesh-nagar, a.ankit Social Media Icons Widget
  • Medium 5.4
    CVE-2023-37387

    WordPress Classified Listing Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.

    RadiusTheme Classified Listing
  • Medium 4.3
    CVE-2022-47169

    WordPress Visibility Logic for Elementor Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StaxWP Visibility Logic for Elementor plugin <= 2.3.4 versions.

    StaxWP Visibility Logic for Elementor
  • Medium 5.4
    CVE-2023-37386

    WordPress Media Library Helper by Codexin Plugin <= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.

  • Medium 4.3
    CVE-2023-25475

    WordPress Smart YouTube PRO Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Smart YouTube PRO plugin <= 4.3 versions.

    Vladimir Prelovac Smart YouTube PRO
  • Medium 4.3
    CVE-2022-45828

    WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.

    NooTheme Noo Timetable
  • Medium 5.4
    CVE-2022-46857

    WordPress SiteAlert (Formerly WP Health) Plugin <= 1.9.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in SiteAlert plugin <= 1.9.7 versions.

    sitealert SiteAlert
  • Medium 5.4
    CVE-2023-25473

    WordPress Flickr Justified Gallery Plugin <= 3.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions.

    miro.mannino Flickr Justified Gallery
  • Medium 4.3
    CVE-2023-25482

    WordPress WP Tiles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <= 1.1.2 versions.

    Mike Martel WP Tiles
  • Medium 4.3
    CVE-2022-38062

    WordPress Download Theme Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <= 1.0.9 versions.

    Metagauss Download Theme
  • Medium 4.3
    CVE-2022-36424

    WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions.

    Nikola Loncar Easy Appointments
  • Medium 4.3
    CVE-2023-37985

    WordPress Five Star Restaurant Menu Plugin <= 2.4.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in FiveStarPlugins Restaurant Menu and Food Ordering plugin <= 2.4.6 versions.

    Five Star Plugins Restaurant Menu and Food Ordering by Five Star Plugins
  • Medium 5.4
    CVE-2023-37974

    WordPress WP-FB-AutoConnect Plugin <= 4.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Justin Klein WP Social AutoConnect plugin <= 4.6.1 versions.

    Justin Klein WP Social AutoConnect
  • Medium 5.4
    CVE-2023-37968

    WordPress Falang multilanguage Plugin <= 1.3.39 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions.

    Faboba Falang multilanguage for WordPress Web / CMS
  • Medium 6.5
    CVE-2023-34005

    WordPress Front End Users Plugin <= 3.2.24 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <= 3.2.24 versions.

    Etoile Web Design Front End Users
  • Medium 4.3
    CVE-2022-47172

    WordPress WooLentor Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions.

    HasThemes ShopLentor
  • Medium 6.5
    CVE-2023-36514

    WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.

    woocommerce Shipping Multiple Addresses
  • Medium 5.4
    CVE-2023-36513

    WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions.

    woocommerce AutomateWoo
  • Medium 4.3
    CVE-2023-36511

    WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions.

    woocommerce WooCommerce Order Barcodes Web / CMS
  • Medium 4.3
    CVE-2023-31216

    WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions.

    Ultimate Member Ultimate Member
  • Medium 5.4
    CVE-2023-35880

    WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions.

    woocommerce WooCommerce Brands Web / CMS
  • Medium 5.4
    CVE-2023-35096

    WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions.

    myCred myCred
  • Medium 4.3
    CVE-2023-35089

    WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions.

    Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes
  • Unscored —
    CVE-2023-3179

    POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF

    The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a passwo…

    Web / CMS
  • Medium 5.4
    CVE-2023-35038

    WordPress WP PDF Generator Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in wpexperts.Io WP PDF Generator plugin <= 1.2.2 versions.

    WPExperts.io WP PDF Generator