Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,785 results · Feed

  • Medium 4.8
    CVE-2020-13527

    An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.…

  • Unscored —
    CVE-2019-19289

    A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow a Cross-Site Request For…

    Siemens XHQ ICS / OT
  • Unscored —
    CVE-2020-14368 Public exploit

    A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with coo…

  • Unscored —
    CVE-2020-8282

    A security issue was found in EdgePower 24V/54V firmware v1.7.0 and earlier where, due to missing CSRF protections, an …

  • Low 3.5
    CVE-2020-28838

    OpenCart Cross-Site Request Forgery (CSRF)

    Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart.

    opencart/opencart Packagist
  • High 8.1
    CVE-2020-2321

    CSRF vulnerability in Jenkins Shelve Project Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project.

    Jenkins Project Jenkins Shelve Project Plugin org.jenkins-ci.plugins:shelve-project-plugin Web / CMS Maven
  • Unscored —
    CVE-2020-14369

    This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to…

  • Medium 6.3
    CVE-2020-7780

    Cross-site Request Forgery (CSRF)

    This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints …

    com.softwaremill.akka-http-session:core_2.12 com.softwaremill.akka-http-session:core_2.13 com.softwaremill.akka-http-session:core_2.11 Maven
  • High 7.0
    CVE-2020-7332

    Cross-Site Request Forgery (CSRF) in firewall ePO extension of McAfee Endpoint Security (ENS)

    Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacker to execute arbitrary HTML code due to incorrect security configuration.

    McAfee Endpoint Security for Windows Windows
  • High 8.8
    CVE-2019-7357 Public exploit

    Subrion CMS CSRF Vulnerability

    Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.

    intelliants/subrion Packagist
  • High 8.1
    CVE-2020-15259

    CSRF in Auth0 ad-ldap-connector

    ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on …

    auth0 ad-ldap-connector
  • Medium 4.3
    CVE-2020-2303

    CSRF vulnerability in Jenkins Active Directory Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified cre…

    Jenkins Project Jenkins Active Directory Plugin org.jenkins-ci.plugins:active-directory Web / CMS Maven
  • High 8.8
    CVE-2020-3456

    Cisco FXOS Software Firepower Chassis Manager Cross-Site Request Forgery Vulnerability

    A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerability is due to insuffi…

    Cisco Cisco Adaptive Security Appliance (ASA) Software Network devices
  • High 8.8
    CVE-2020-12502

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…

    Pepperl+Fuchs Westermo Korenix JetNet
  • Medium 4.3
    CVE-2020-2296

    CSRF vulnerability in Jenkins Shared Objects Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects.

    Jenkins Project Jenkins Shared Objects Plugin org.jenkins-ci.plugins:shared-objects Web / CMS Maven
  • Medium 6.5
    CVE-2020-2295

    CSRF vulnerability in Jenkins Maven Cascade Release Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin.

    Jenkins Project Jenkins Maven Cascade Release Plugin com.barchart.jenkins:maven-release-cascade Web / CMS Maven
  • Medium 4.3
    CVE-2020-25262

    PyroCMS Vulnerable to CSRF

    PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

    pyrocms/pyrocms Packagist
  • High 7.1
    CVE-2020-25263

    PyroCMS Vulnerable to CSRF

    PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted.

    pyrocms/pyrocms Packagist
  • High 8.8
    CVE-2020-2280

    CSRF vulnerability in Jenkins warnings Plugin allows remote code execution

    A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code.

    Jenkins Project Jenkins Warnings Plugin org.jvnet.hudson.plugins:warnings Web / CMS Maven
  • Medium 5.4
    CVE-2020-2281

    CSRF vulnerability in Jenkins Lockable Resources Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and reset resources.

    Jenkins Project Jenkins Lockable Resources Plugin org.6wind.jenkins:lockable-resources Web / CMS Maven
  • High 8.8
    CVE-2019-16009

    Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

    A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the…

    Cisco Cisco IOS 12.2(15)B iOS Network devices
  • Medium 6.5
    CVE-2020-3124

    Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to ins…

    Cisco Cisco Hosted Collaboration Mediation Fulfillment Network devices
  • Medium 6.5
    CVE-2020-3135

    Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. The vulnerability is due to insuff…

    Cisco Cisco Unified Communications Manager Network devices
  • Low 3.4
    CVE-2020-14506

    Philips Clinical Collaboration Platform Cross-site Request Forgery

    Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.

    Philips Clinical Collaboration Platform
  • High 8.4
    CVE-2020-15182

    Cross-site Request Forgery leading to RCE in SOY CMS

    The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files…

    inunosinsi soycms
  • Medium 4.3
    CVE-2020-2273

    CSRF vulnerability in Jenkins ElasTest Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

    Jenkins Project Jenkins ElasTest Plugin org.jenkins-ci.plugins:elastest Web / CMS Maven
  • Medium 5.3
    CVE-2020-2268

    CSRF vulnerability in MongoDB Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller.

    Jenkins Project Jenkins MongoDB Plugin org.jenkins-ci.plugins:mongodb Web / CMS Maven
  • Low 2.0
    CVE-2018-19948

    The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forg…

    QNAP Systems Helpdesk
  • Unscored —
    CVE-2020-15789

    A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cr…

    Siemens Polarion Subversion Webclient ICS / OT
  • Unscored —
    CVE-2020-16208

    The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different confi…

  • High 8.8
    CVE-2020-5776 Scanner template EPSS 15%

    Cross-Site Request Forgery in MAGMI

    Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.

    dweeves/magmi Packagist
  • High 8.8
    CVE-2020-2240

    CSRF vulnerability in Jenkins Database Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripts.

    Jenkins Project Jenkins database Plugin org.jenkins-ci.plugins:database Web / CMS Maven
  • Medium 5.4
    CVE-2020-2241

    CSRF vulnerability in Jenkins Database Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database server using attacker-specified credentials.

    Jenkins Project Jenkins database Plugin org.jenkins-ci.plugins:database Web / CMS Maven
  • Medium 6.5
    GHSA-6qqj-rx4w-r3cj

    CSRF Vulnerability in jquery-ujs

    Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains. When an attacker controls the href attribute of an ancho…

    jquery-ujs npm
  • Medium 6.8
    CVE-2020-15156

    XSS due to lack of CSRF validation for replying/publishing

    In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.

    psychobunny nodebb-plugin-blog-comments nodebb-plugin-blog-comments npm
  • High 8.8
    CVE-2020-14043

    Codiad CSRF Vulnerability

    ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/…

    codiad/codiad Packagist
  • High 8.0
    CVE-2020-15151

    Observable Timing Discrepancy in OpenMage LTS

    OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patche…

    OpenMage magento-lts openmage/magento-lts Web / CMS Packagist
  • Medium 6.5
    CVE-2020-12480

    CSRF in Play Framework

    In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.

    com.typesafe.play:play_2.12 Maven
  • High 7.6
    CVE-2020-7304

    DLP ePO extension - Cross-site request forgery

    Cross site request forgery vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attacker to embed a CRSF script via adding a new label.

    McAfee DLP ePO extension
  • High 7.1
    CVE-2020-2235

    CSRF vulnerability in Jenkins Pipeline Maven Integration Plugin allow capturing credentials

    A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentiall…

    Jenkins Project Jenkins Pipeline Maven Integration Plugin org.jenkins-ci.plugins:pipeline-maven Web / CMS Maven