Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,786 results · Feed

  • Unscored —
    CVE-2016-9456

    Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a secur…

  • High 8.8
    CVE-2017-6068

    Subrion CMS vulnerable to CSRF in admin/blocks/add

    Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter.

    intelliants/subrion Packagist
  • High 7.5
    CVE-2017-6379

    Drupal Cross-Site Request Forgery (CSRF)

    Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Packagist
  • High 8.8
    CVE-2015-8814

    Umbraco CMS vulnerable to CSRF

    Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.

    Umbraco.Cms NuGet
  • Unscored —
    CVE-2017-2682

    The Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform…

    Linux Windows
  • High 8.8
    CVE-2016-9365

    An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5…

  • Medium 4.5
    CVE-2016-4808 Public exploit

    Web2py Cross-Site Request Forgery vulnerability

    Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just…

    web2py PyPI
  • High 8.8
    CVE-2016-6277 Exploited Public exploit Scanner template EPSS 100%

    NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.…

    KEV Mar 7, 2022
  • Critical 9.8
    CVE-2016-9866

    phpMyAdmin CSRF Vulnerability

    An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist
  • Critical 9.6
    CVE-2016-6637

    Cloud Foundry vulnerable to Cross-Site Request Forgery

    Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.…

    org.cloudfoundry.identity:cloudfoundry-identity-server Maven
  • High 8.8
    CVE-2016-6801

    Apache Jackrabbit Authentication Hijacking Vulnerability

    Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows re…

    jackrabbit jackrabbit org.apache.jackrabbit:jackrabbit-webdav Debian Ubuntu Maven
  • High 8.8
    CVE-2016-4430

    Apache Struts CSRF Vulnerability

    Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

    org.apache.struts.xwork:xwork-core Maven
  • High 8.8
    CVE-2016-2157

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of adminis…

    moodle/moodle moodle Ubuntu Packagist
  • High 8.8
    CVE-2015-5351

    Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mech…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 8.8
    CVE-2015-5338

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5335

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests th…

    moodle/moodle Packagist
  • High 8.8
    CVE-2015-7537

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2015-7538

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2015-8379

    CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter

    CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.

    cakephp/cakephp cakephp Debian Packagist
  • High 8.8
    CVE-2015-2912

    OrientDB-Server vulnerable to Cross-Site Request Forgery

    The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sen…

    com.orientechnologies:orientdb-studio Maven
  • Low —
    CVE-2015-5318

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2015-0218

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that tri…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-0213

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack th…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-1585

    Fat Free CRM Cross-Site Request Forgery vulnerability

    Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.

    fat_free_crm RubyGems
  • High 8.0
    CVE-2014-100005 Exploited Public exploit EPSS 43%

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17…

    KEV May 16, 2024
  • Medium —
    CVE-2014-8144

    Doorkeeper vulnerable to Cross-site Request Forgery

    Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

    doorkeeper RubyGems
  • Medium —
    CVE-2014-7809

    Cross-Site Request Forgery in Apache Struts

    Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.

    org.apache.struts:struts2-core Maven
  • Medium —
    CVE-2014-7838

    Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that se…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7836

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/requ…

    moodle/moodle Packagist
  • Medium 5.3
    CVE-2012-5500

    Plone contains Cross-site Request Forgery

    The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

    plone PyPI
  • Medium 4.3
    CVE-2014-2358

    Fox-IT DataDiode Appliance CSRF

    Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative web interface in the proxy server on Fox-IT Fox DataDiode appliances before 1.7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) crea…

    Fox-IT DataDiode Appliance
  • Medium —
    CVE-2014-0168

    Cross-Site Request Forgery in Jolokia

    Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

    org.jolokia:jolokia-core Maven
  • Medium 4.6
    CVE-2014-2369

    Omron NS Series HMI Cross-Site Request Forgery

    Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

    Omron NS12 NS8 NS15 ICS / OT
  • Medium —
    CVE-2014-4671 Public exploit EPSS 22%

    Rosetta-Flash JSONP Vulnerability in hapi

    Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restr…

    flashplugin-nonfree hapi Ubuntu npm
  • Medium —
    CVE-2014-0213

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of …

    moodle/moodle Packagist
  • Medium —
    CVE-2013-2034

    Jenkins Cross-Site Request Forgery vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests th…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-4562

    omniauth-facebook Cross-Site Request Forgery vulnerability

    The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

    omniauth-facebook RubyGems
  • High —
    CVE-2013-7259

    Neo4J vulnerable to Cross-Site Request Forgery

    Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/exe…

    org.neo4j:neo4j Maven
  • Medium —
    CVE-2014-0054 EPSS 91%

    Cross-Site Request Forgery in Spring Framework

    The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF atta…

    libspring-java org.springframework:spring-webmvc Debian Maven
  • Medium —
    CVE-2014-0126

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests t…

    moodle/moodle Packagist