Skip to content
Noroxi

CWE-352 · 9,678 records

Cross-site request forgery

Why does it happen?

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

How to prevent it

  1. 01Add an anti-CSRF token to every state-changing request.
  2. 02Use the SameSite attribute on session cookies.
  3. 03Require re-authentication for critical actions.

Vulnerable and fixed code

A representative teaching example. Highlighted lines mark where the bug and the fix are.

Vulnerable

ts
app.use(session({ cookie: { httpOnly: true } }));app.post("/account/address", updateAddress);

Fixed

ts
app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));app.post("/account/address", csrfProtection, updateAddress);

Is this pattern in your code?

We look for this class specifically as part of our Web and API penetration testing service. Findings are delivered with line numbers.

Web and API penetration testingRequest a quote

CVEs in this class

9,685 records

  • CVE-2016-6277
    95Now

    NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    netgear · d6220 firmwareDec 14, 2016

  • CVE-2014-100005
    75This week

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev.

    HighCVSS 8.0KEVWeaponizedEPSS 43%

    dlink · dir-600 firmwareJan 13, 2015

  • CVE-2023-2533
    74This week

    PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF

    HighCVSS 8.8KEVWeaponizedEPSS 28%

    papercut · papercut mfJun 20, 2023

  • CVE-2020-10181
    73This week

    goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (admini

    CriticalCVSS 9.8KEVWeaponizedEPSS 14%

    sumavision · enhanced multimedia router firmwareMar 11, 2020

  • CVE-2008-4128
    72This week

    Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Serv

    HighCVSS 8.1KEVWeaponizedEPSS 33%

    cisco · iosSep 18, 2008

  • CVE-2022-41622
    63This week

    iControl SOAP vulnerability

    HighCVSS 8.8WeaponizedEPSS 92%

    f5 · big-iq centralized managementDec 7, 2022

  • CVE-2017-1000479
    60This week

    pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrar

    HighCVSS 8.8WeaponizedEPSS 31%

    netgate · pfsenseJan 3, 2018

  • CVE-2016-6897
    60This week

    Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef

    MediumCVSS 6.5WeaponizedEPSS 28%

    wordpress · wordpressJan 18, 2017

  • CVE-2013-3568
    60This week

    Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for re

    HighCVSS 8.8WeaponizedEPSS 25%

    cisco · linksys wrt110 firmwareFeb 6, 2020

  • CVE-2019-19833
    60This week

    In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.

    MediumCVSS 6.5WeaponizedEPSS 14%

    tautulli · tautulliDec 18, 2019

  • CVE-2024-34069
    60This week

    Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

    HighCVSS 7.5WeaponizedEPSS 3%

    palletsprojects · werkzeugMay 6, 2024

  • CVE-2018-7700
    57Plan

    DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify

    HighCVSS 8.8Proof of conceptEPSS 74%

    dedecms · dedecmsMar 27, 2018

  • CVE-2014-0054
    54Plan

    The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external ent

    MediumCVSS 6.8No exploitEPSS 91%

    springsource · spring frameworkApr 17, 2014

  • CVE-2013-6429
    54Plan

    The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entit

    MediumCVSS 6.8No exploitEPSS 90%

    pivotal software · spring frameworkJan 26, 2014

  • CVE-2019-16667
    51Plan

    diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands.

    HighCVSS 8.8Proof of conceptEPSS 54%

    netgate · pfsenseSep 26, 2019

  • CVE-2015-2295
    47Plan

    Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote

    MediumCVSS 6.8Proof of conceptEPSS 65%

    netgate · pfsenseApr 10, 2015

  • CVE-2019-9787
    47Plan

    WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default conf

    HighCVSS 8.8Proof of conceptEPSS 38%

    wordpress · wordpressMar 14, 2019

  • CVE-2022-1020
    47Plan

    Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    codeastrology · woo product tableApr 18, 2022

  • CVE-2015-6973
    46Plan

    Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentic

    MediumCVSS 6.8Proof of conceptEPSS 64%

    igniterealtime · openfireSep 16, 2015

  • CVE-2022-27226
    45Plan

    A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administ

    HighCVSS 8.8Proof of conceptEPSS 33%

    irz · ru21 firmwareMar 19, 2022

  • CVE-2019-0235
    45Plan

    Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.

    HighCVSS 8.8Proof of conceptEPSS 32%

    apache · ofbizApr 30, 2020

  • CVE-2022-28731
    44Plan

    Apache JSPWiki CSRF in UserPreferences.jsp

    MediumCVSS 6.5No exploitEPSS 58%

    apache · jspwikiAug 4, 2022

  • CVE-2022-1574
    43Plan

    HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    html2wp project · html2wpJun 27, 2022

  • CVE-2023-48292
    42Plan

    XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks

    HighCVSS 8.8Proof of conceptEPSS 22%

    xwiki · admin toolsNov 20, 2023

  • CVE-2022-28108
    42Plan

    Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/f

    HighCVSS 8.8Proof of conceptEPSS 22%

    selenium · selenium gridApr 18, 2022

All vulnerability classes