Weakness (CWE)
CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
How to prevent it (7 mitigations)
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
-
Implementation
Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
-
Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
-
Architecture and Design
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
-
Architecture and Design
Use the "double-submitted cookie" method as described by Felten and Zeller:
When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
-
Architecture and Design
Do not use the GET method for any request that triggers a state change.
-
Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
Source: MITRE CWE-352
6,783 results · Feed
-
High 8.8
Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, captur…
-
Medium 5.7
Cross-site request forgery vulnerability in Jenkins Bitbucket OAuth Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account.
-
Medium 6.5
Cross-site request forgery in Jenkins Gerrit Trigger Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
-
High 8.8
A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escala…
-
Medium —
CakePHP has incorrect Cross-Site Request Forgery validation
CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.
-
Medium 5.4
Social Warfare <= 4.3.1 - Cross-Site Request Forgery
The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes it possible for unauthenticated attackers to …
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
-
Medium 4.3
Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgery
The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This makes it possible for unauthentic…
-
High 8.1
CVE-2022-47395
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operat…
-
High 8.1
CVE-2022-45127
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary backup operations a…
-
High 7.5
Panasonic Sanyo CCTV Network Camera
Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to perform changes with administrator level privileges.
-
Medium 4.3
WordPress OSM – OpenStreetMap Plugin <= 6.0.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) in MiKa's OSM – OpenStreetMap plugin <= 6.0.1 versions.
-
High 8.1
Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-P…
-
High 8.8
Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
-
Medium 6.5
Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php.
-
High 8.8
Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgery
The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on its AJAX actions function. This makes it possible for unau…
-
Medium 6.8
Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation
Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation vulnerability that may allow privilege escalation.
-
Medium 6.8
Rumpus - FTP server Cross-site request forgery (CSRF) – Create user
Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) – vulnerability may allow unauthorized action on behalf of authenticated users.
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation
The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated att…
-
Medium 5.3
Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows…
-
High 8.8
Swifty Page Manager <= 3.0.1 - Cross-Site Request Forgery
The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other thin…
-
Medium 5.4
JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to …
-
Low 3.5
OpenACS bug-tracker Search nav-bar.adp cross-site request forgery
A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component Search. The manipulation leads to cross-site request forgery. It is possible to launch the attack rem…
-
Critical 9.1CVE-2023-22457 EPSS 19%
org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery
CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the curren…
-
Medium 4.3
IBM Business Automation Workflow cross-site request forgery
IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
-
Medium 4.3
valtech IDP Test Client main.py cross-site request forgery
A vulnerability was found in valtech IDP Test Client and classified as problematic. Affected by this issue is some unknown functionality of the file python-flask/main.py. The manipulation leads to cross-site request forgery. The attack may be launched remotel…
-
Low 3.5
Cross-Site Request Forgery (CSRF) in froxlor/froxlor
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.3
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.7
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.3
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.8
Cryptographically weak random number generation in github.com/dinever/golf
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.
-
Medium 4.3
dolibarr_project_timesheet Form cross-site request forgery
A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated …
-
Medium 4.3
moodle-block_sitenews block_sitenews.php get_content cross-site request forgery
A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack re…
-
High 8.8
Togglz console missing cross-site request forgery (CSRF) protection
The console in Togglz before 2.9.4 allows CSRF.
-
Medium 4.3
destiny.gg chat main.go websocket.Upgrader cross-site request forgery
A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the…
-
Medium 5.3
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.