Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,786 results · Feed

  • High 8.8
    CVE-2016-6806

    Apache Wicket vulnerable to CSRF attacks

    Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account…

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket-core Maven
  • High 8.8
    CVE-2015-7293 Public exploit

    Plone vulnerable to cross-site request forgery

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

    plone PyPI
  • High 8.8
    CVE-2017-14683

    Gem in a Box vulnerable to Cross-site Request Forgery

    geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.

    geminabox RubyGems
  • High 8.8
    CVE-2015-0276

    Kallithea cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.

    kallithea PyPI
  • Unscored —
    CVE-2017-12253

    A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unw…

  • High 8.8
    CVE-2015-5607

    IPython vulnerable to cross site request forgery (CSRF)

    Cross-site request forgery in the REST API in IPython 2 and 3.

    ipython ipython ipython Debian Ubuntu PyPI
  • High 8.8
    CVE-2016-8737

    Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)

    In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the att…

    Apache Software Foundation Apache Brooklyn org.apache.brooklyn:brooklyn-rest-resources org.apache.brooklyn:brooklyn-jsgui Maven
  • High 8.8
    CVE-2015-4619

    Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.

    spina RubyGems
  • Unscored —
    CVE-2017-7926

    A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0). The vulnerabili…

  • High 8.8
    CVE-2015-5258

    springframework-social Cross-Site Request Forgery vulnerability

    Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3.

    org.springframework.social:spring-social-core Maven
  • Unscored —
    CVE-2017-7423

    A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise …

    Micro Focus Micro Focus Enterprise Developer, Micro Focus Enterprise Server
  • Unscored —
    CVE-2017-5187

    A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) …

    Micro Focus Micro Focus Enterprise Developer, Micro Focus Enterprise Server
  • High 8.8
    CVE-2015-5081

    django-cms CSRF Vulnerability

    Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.

    django-cms PyPI
  • High 8.8
    CVE-2017-12881

    Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

    Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability.

    org.springframework.batch:spring-batch-admin-manager Maven
  • High 8.8
    CVE-2017-7556

    Cross-Site Request Forgery in hawtio

    Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user.

    Red Hat hawtio io.hawt:project Maven
  • Unscored —
    CVE-2017-6756

    A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow a…

  • High 8.8
    CVE-2017-7666

    Apache OpenMeetings vulnerable to Cross-Site Request Forgery

    Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.

    Apache Software Foundation Apache OpenMeetings org.apache.openmeetings:openmeetings-parent Maven
  • High 8.8
    CVE-2017-1000069

    Cross-site Request Forgery (CSRF)

    CSRF in Bitly oauth2_proxy 2.1 during authentication flow

    github.com/bitly/oauth2_proxy Go
  • Unscored —
    CVE-2017-6042

    A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, an…

  • Unscored —
    CVE-2017-6038

    A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and pr…

  • High 8.8
    CVE-2017-6086 Public exploit

    ViMbAdmin CSRF Vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request …

    opensolutions/vimbadmin Packagist
  • Unscored —
    CVE-2017-5244

    Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requ…

    Rapid7 Metasploit (Pro, Express, and Community editions)
  • High 8.8
    CVE-2015-1786

    Zend Framework CSRF Vulnerability

    Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.

    zendframework/zendframework Packagist
  • Unscored —
    CVE-2017-7917

    A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous ver…

  • High 8.0
    CVE-2017-5657

    Apache Archiva vulnerable to Cross Site Request Forgery

    Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva service…

    Apache Software Foundation Apache Archiva org.apache.archiva:archiva Maven
  • Unscored —
    CVE-2017-6634

    A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow a…

  • Medium 6.5
    CVE-2017-7620 Public exploit

    MantisBT vulnerable to CSRF and Open Redirect attacks

    MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to …

    mantisbt/mantisbt Packagist
  • High 8.8
    CVE-2017-7662

    Cross-Site Request Forgery in Apache CXF Fediz

    Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in…

    Apache Software Foundation Apache CXF Fediz org.apache.cxf.fediz:fediz-oidc Maven
  • Medium —
    CVE-2017-7661

    Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2

    Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz pri…

    Apache Software Foundation Apache CXF Fediz org.apache.cxf.fediz:fediz-spring2 org.apache.cxf.fediz:fediz-jetty9 Maven
  • Medium 4.5
    CVE-2017-8382 Public exploit

    admidio CSRF Vulnerability

    admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.

    admidio/admidio Packagist
  • Medium 4.3
    CVE-2017-7491

    Moodle Cross-Site Request Forgery (CSRF)

    In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 8.8
    CVE-2016-4879

    CSRF in baserCMS 3.0.10 and earlier

    Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

    baserCMS Users Community baserCMS plugin Mail baserproject/basercms Packagist
  • High 8.8
    CVE-2016-4881

    CSRF in baserCMS 3.0.10 and earlier

    Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

    baserCMS Users Community baserCMS plugin Blog baserproject/basercms Packagist
  • High 8.8
    CVE-2016-4878

    baserCMS Cross Site Request Forgery vulnerability

    Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

    baserCMS Users Community BaserCMS baserproject/basercms Packagist
  • High 8.8
    CVE-2017-8874

    Mautic Cross-Site Request Forgery (CSRF)

    Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete contacts.

    mautic/core Packagist
  • High 8.8
    CVE-2016-3691

    Kallithea Routes CSRF Bypass

    Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method.

    kallithea PyPI
  • High 8.8
    CVE-2016-3734

    Moodle Cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum pos…

    moodle/moodle Packagist
  • Unscored —
    CVE-2017-2688

    The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to p…

  • Unscored —
    CVE-2016-9455

    Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's u…

  • Unscored —
    CVE-2016-9127

    Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adser…