Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Implementation

Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Architecture and Design

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and Design

Use the "double-submitted cookie" method as described by Felten and Zeller:
When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Architecture and Design

Do not use the GET method for any request that triggers a state change.
Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,783 results · Feed

Medium 6.5

CVE-2022-46491

A Cross-Site Request Forgery (CSRF) vulnerability in the Add Administrator function of the default version of nbnbk all…

Dec 22, 2022
Medium 4.3

CVE-2022-4633

Auto Upload Images Settings setting-page.php cross-site request forgery

A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request fo…

Dec 21, 2022
Medium 4.3

CVE-2022-4604

wp-english-wp-admin Plugin english-wp-admin.php register_endpoints cross-site request forgery

A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the function register_endpoints of the file english-wp-admin.php. The manipulation leads to cross-site request forgery. The attack…

Dec 18, 2022
Medium 4.3

CVE-2022-4564

University of Central Florida Materia API Controller api.php before cross-site request forgery

A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-si…

University of Central Florida Materia

Dec 16, 2022
High 8.8

CVE-2022-3427

Corner Ad <= 1.0.56 - Cross-Site Request Forgery

The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corner_ad_settings_page function. This makes it possible for unauthenticated a…

codepeople Corner Ad Web / CMS

Dec 15, 2022
High 8.8

CVE-2022-46074

Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin …

Dec 14, 2022
Medium 6.5

CVE-2022-46059

AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).

Dec 13, 2022
Medium 4.5

CVE-2022-46062

Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).

Dec 13, 2022
Medium 4.3

CVE-2022-41263

Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - version…

SAP Business Objects Business Intelligence Platform (Web intelligence)

Dec 12, 2022
Low 3.5

CVE-2022-45228

Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page.

Dec 12, 2022
High 8.8

CVE-2022-45980

Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .

Dec 12, 2022
High 8.8

CVE-2022-41622 Public exploit EPSS 92%

iControl SOAP vulnerability

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

F5 BIG-IP BIG-IQ Centralized Management Network devices

Dec 7, 2022
Medium 6.5

CVE-2022-46688

Jenkins Sonar Gerrit Plugin vulnerable to Cross-Site Request Forgery

A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials ID…

Jenkins Project Jenkins Sonar Gerrit Plugin org.jenkins-ci.plugins:sonar-gerrit Web / CMS Maven

Dec 7, 2022
High 8.8

CVE-2022-44849

A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super…

Dec 7, 2022
High 8.8

CVE-2022-23475

dalorRadius full account take over

daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to account takeover in the mng-del.php file bec…

lirantal daloradius

Dec 6, 2022
Medium 5.4

CVE-2022-45824

WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.

Advanced Booking Calendar Advanced Booking Calendar

Dec 5, 2022
High 7.3

CVE-2022-43470

Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software v…

FUJI SOFT +F FS040U, +F FS020W, +F FS030W, and +F FS040W

Dec 5, 2022
Medium 4.3

CVE-2022-35730

WordPress Oceanwp sticky header plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress.

Oren Hahiashvili Oceanwp sticky header

Dec 4, 2022
Medium —

GHSA-47xh-qxqv-mgvg

kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF)

### Impact > A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing …

github.com/mittwald/kube-httpcache Go

Dec 2, 2022
Medium 5.4

CVE-2022-4220

Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to dele…

prasunsen Chained Quiz Web / CMS

Dec 2, 2022
Medium 5.4

CVE-2022-4219

Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible for unauthenticated attackers to delete submi…

prasunsen Chained Quiz Web / CMS

Dec 2, 2022
Medium 5.4

CVE-2022-4218

Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated attackers to delete…

prasunsen Chained Quiz Web / CMS

Dec 2, 2022
Medium 6.5

CVE-2022-45667

Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.

Dec 2, 2022
Medium 6.5

CVE-2022-45673

Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.

Dec 2, 2022
Medium 6.5

CVE-2022-45674

Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

Dec 2, 2022
Medium 6.5

CVE-2022-45668

Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

Dec 2, 2022
Medium 4.3

CVE-2022-41297

IBM Db2U cross-site request forgery

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212.

IBM Db2U

Dec 1, 2022
Medium 6.5

CVE-2022-41296

IBM Db2U cross-site respect forgery

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210.

IBM Db2U

Dec 1, 2022
High 8.8

CVE-2022-40489

ThinkCMF Cross Site Request Forgery (CSRF) vulnerability

ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.

thinkcmf/thinkcmf Packagist

Dec 1, 2022
Medium 5.4

CVE-2022-26366

WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.

Arnan de Gans AdRotate Banner Manager (WordPress plugin) Web / CMS

Nov 30, 2022
Medium 4.3

CVE-2022-41413 Public exploit

perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attac…

Nov 30, 2022
High 8.8

CVE-2022-3898

WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery

The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it p…

Tips and Tricks HQ WP Affiliate Platform Web / CMS

Nov 29, 2022
High 8.8

CVE-2022-3747

Becustom <= 1.0.5.2 - Cross-Site Request Forgery

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update …

Muffin Group Becustom Web / CMS

Nov 29, 2022
Medium 4.3

CVE-2022-34654

WordPress Manage Notification E-mails Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.

Virgial Berveling Manage Notification E-mails (WordPress plugin) Web / CMS

Nov 28, 2022
Medium 6.5

CVE-2022-44937

Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrat…

Nov 28, 2022
High 8.8

CVE-2022-23044

Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actio…

Nov 25, 2022
Medium 4.3

CVE-2020-23588 Public exploit

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

Nov 23, 2022
Medium 4.3

CVE-2020-23586 Public exploit

A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an una…

Nov 23, 2022
Medium 6.5

CVE-2020-23589 Public exploit

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

Nov 23, 2022
Low 3.1

CVE-2020-23587 Public exploit

A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an…

Nov 23, 2022