Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,780 results · Feed

  • Medium 4.3
    CVE-2024-45270

    WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero…

    Sayful Islam Carousel Slider Web / CMS
  • Medium 4.3
    CVE-2024-45269

    WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Caro…

    Sayful Islam Carousel Slider Web / CMS
  • Medium 4.3
    CVE-2024-8319

    Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions

    The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf…

    themefic Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin Web / CMS
  • Medium 5.4
    CVE-2024-43947

    WordPress WP Armour Extended plugin <= 1.26 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26.

    Dinesh Karki WP Armour Extended
  • Medium 5.4
    CVE-2024-42793

    A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted req…

  • Medium 4.3
    CVE-2024-8200

    Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Cross-Site Request Forgery

    The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce v…

    smub Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More Web / CMS
  • High 8.0
    CVE-2024-45264 Public exploit

    A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remot…

  • Medium 5.4
    CVE-2024-39628

    WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.

    Saturday Drive Ninja Forms
  • Medium 4.3
    CVE-2024-39641

    WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2.

    ThimPress LearnPress
  • Medium 5.4
    CVE-2024-39645

    WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.

    Themeum Tutor LMS
  • Medium 4.3
    CVE-2024-39657

    WordPress Sender plugin <= 2.6.18 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18.

    Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2024-43116

    WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10.

    10up Simple Local Avatars
  • Medium 4.3
    CVE-2024-43117

    WordPress Hummingbird plugin <= 3.9.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.

    WPMU DEV - Your All-in-One WordPress Platform Hummingbird
  • Medium 4.3
    CVE-2024-43265

    WordPress Analytify plugin <= 5.3.1 - CSRF Leading to Optout Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.3.1.

    Analytify Analytify
  • Medium 4.3
    CVE-2024-43269

    WordPress Backup and Restore WordPress plugin <= 1.50 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: from n/a through 1.50.

    WPBackItUp Backup and Restore WordPress Web / CMS
  • Medium 4.3
    CVE-2024-43287

    WordPress Brevo plugin <= 3.1.82 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82.

    Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
  • Medium 4.3
    CVE-2024-43295

    WordPress WP Data Access plugin <= 5.5.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7.

    Passionate Programmers WP Data Access
  • Medium 5.4
    CVE-2024-43299

    WordPress SpeedyCache plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Softaculous SpeedyCache speedycache.This issue affects SpeedyCache: from n/a through <= 1.1.8.

    Softaculous SpeedyCache
  • High 7.1
    CVE-2024-43301

    WordPress Fonts plugin <= 3.7.7 - Cross Site Request Forgery (CSRF) to Stored XSSvulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fonts Plugin Fonts allows Stored XSS.This issue affects Fonts: from n/a through 3.7.7.

    Fonts Plugin Fonts
  • Medium 4.3
    CVE-2024-43316

    WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.

    Checkout Plugins Stripe Payments For WooCommerce by Checkout Web / CMS
  • Medium 4.3
    CVE-2024-43325

    WordPress Dark Mode for WP Dashboard plugin <= 1.2.3 - Cross Site Request Forgery vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3.

    Naiche Dark Mode for WP Dashboard
  • Medium 4.3
    CVE-2024-43336

    WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through <= 2.9.10.

    WP User Manager WP User Manager
  • Medium 4.3
    CVE-2024-43337

    WordPress Brave plugin <= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0.

    Brave Brave Popup Builder
  • Medium 4.3
    CVE-2024-43340

    WordPress AFI – The Easiest Integration Plugin plugin <= 1.89.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4.

    Nasir Ahmed Advanced Form Integration
  • Medium 4.3
    CVE-2024-43356

    WordPress oik plugin <= 4.12.0 - Arbitrary File Deletion vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0.

    bobbingwide oik
  • Medium 5.4
    CVE-2024-43339

    WordPress WordPress Webinar Plugin – WebinarPress plugin <= 1.33.20 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20.

    WebinarPress WebinarPress
  • Low 3.5
    CVE-2024-42792

    A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.p…

  • Medium 4.7
    CVE-2024-8120

    ImageRecycle pdf & image compression <= 3.1.14 - Cross-Site Request in Several AJAX Actions

    The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer…

    ImageRecycle ImageRecycle pdf & image compression Web / CMS
  • Critical 9.6
    CVE-2024-7568

    Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion

    The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthentica…

    brandondove Favicon Generator (CLOSED) Web / CMS
  • Critical 9.4
    CVE-2024-42764

    Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php.

  • Medium 5.0
    CVE-2024-43787

    Hono CSRF middleware can be bypassed using crafted Content-Type header

    Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result,…

    honojs hono hono npm
  • Medium 4.3
    CVE-2024-39744

    IBM Sterling Connect:Direct Web Services cross-site request forgery

    IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

    IBM Sterling Connect:Direct Web Services
  • Medium 4.6
    CVE-2024-40886

    One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management …

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 6.5
    CVE-2024-42056

    Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials …

  • Medium 6.8
    CVE-2024-42768

    A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete…

  • Medium 6.5
    CVE-2024-20486

    Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulne…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.1
    CVE-2024-7647

    OTA Sync Booking Engine Widget 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing or incorrect nonce validation on the otasync_widget_settings_fnc() function. This makes it …

    otasync OTA Sync Booking Engine Widget Web / CMS
  • Medium 6.1
    CVE-2024-7850

    BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

    The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or incorrect nonce validation on the bps_ajax_field_selector(), bps_ajax_template_options(), and bps_aja…

    dontdream BP Profile Search Web / CMS
  • Medium 5.7
    CVE-2024-42606

    Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?c…

  • High 8.8
    CVE-2024-42584

    A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attac…