Common Weakness Enumeration

CWE-352

Allowed

Cross-Site Request Forgery (CSRF)

Abstraction: Compound · Status: Stable

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

14231 vulnerabilities reference this CWE, most recent first.

GHSA-J6W6-986J-2M2M

Vulnerability from github – Published: 2026-05-14 20:18 – Updated: 2026-05-19 15:58

Summary

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Details

Summary

An application-wide Cross-Site Request Forgery (CSRF) vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this vulnerability, and any user who views the compromised image (e.g., a profile picture) will unknowingly send a GET request to the attacker-controlled URL. This can lead to cookie theft, denial of service (DoS), or other malicious actions.

This can be exploited in various locations, including:

• Profile picture

• Model picture

• Hidden images in shared chats

• Images within shared notes

Details

Vulnerable Code:

This appears to occur in most locations where images can be uploaded/rendered. Here are found sinks:

Profile Image in chat

• Note: rendering profile picture in chat

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/ProfileImage.svelte#L16Code

Profile Picture edit

• Note: Profile picture rendering in edit

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Settings/Account.svelte#L205

Profile Image Navbar

• Note: Profile picture rendering in navbar

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Navbar.svelte#L237

Profile Image UserList

• Note: rendering images in user list admin panel

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/admin/Users/UserList.svelte#L399

Images in chat

• Note: rendering images in chat

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/common/Image.svelte#L35

Image in chat

• Note: Image sent in chat

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/channel/Messages/Message.svelte#L192 Model image in chat

• Note: Model image rendering in chat

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Placeholder.svelte#L128

Model image in chat response

• Note: Model image rendering in the assistant response

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/ResponseMessage.svelte#L612

Model Image Admin settings

• Note: Model image rendering in the admin settings

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/admin/Settings/Models.svelte#L336

Model Image Workspace

• Note: Model image rendering in the workspace

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/workspace/Models.svelte#L336

Model Image Edit

• Note: Model image rendering in the edit modal

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/workspace/Models/ModelEditor.svelte#L407

Image in Notes

• Note: Image rendering in shared note

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/common/RichTextInput/Image/image.ts#L140

• Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/UserMessage.svelte#L184

Root Cause

Insecure display of image

• Application is sending a GET request to the unvalidated image url

Lack of Input Validation

• Image url is not validated for filetype

PoCs

PoC (profile picture)

Environment

• Open-WebUl latest version (v0.6.41)

• Valid user

Step 1: Create a Malicious Link

• Set up a server to obtain victim's cookies, ip, referer, user-agent, etc

Step 2: Profile Image URL

Add user
Change the profile image url parameter to the malicious URL (server was used for PoC)
Example POST request:

Repeat action
1. Repeat for userSignUp, updateUserProfile, and update

Step 3: View Image on Victim Admin Account

Log into an admin account
Visit the admin panel (/admin/users/overview)
Notice the GET request sent to the malicious URL

Step 4: Verify User Information Is Sent

Confirm user information is sent

PoC (chat)

Environment

• Open-WebUl latest version (v0.6.41)

• Valid user

Step 1: Create a Malicious Link

• Set up a server to obtain victim's cookies, ip, referer, use-agent, etc

Step 2: Start chat

Start chat
Send a message
Resend POST request
Resend post request to this endpoint /api/v1/chats/[chat_id_here]
Add in a file with type set to image and the url set to the malicious link
Replace models/ids/malicious_url_here with what is applicable
{"chat":{"models":["redacted"],"history":{"messages":{"id_here":{"id":"id_here","parentId":"id_here","childrenIds":["id_here"],"role":"user","content":"","files":[{"type":"image","url":"MALICIOUS_URL_HERE"}],"timestamp":1765978991,"models":["redacted"]}}},"params":{},"files":[]}}

Share chat
1. Copy link to share the chat

Step 3: View Image on Victim Account

Log into a valid account
Open the shared chat
Notice the GET request sent to the malicious URL from the hidden image on the page

Step 4: Verify User Information Is Sent

Confirm user information is sent

PoC (notes)

Environment

• Open WebUI latest version (v0.6.41)

• Valid user with access to notes

Step 1: Create a Malicious Link

• Set up a server to obtain victim's cookies, ip, referer, use-agent, etc

Step 2: Create Note

Resend POST request to /api/v1/notes/[note_id_here]/update
Add in the malicious URL to a file
Example parameters

1. (replace the ID_HERE with valid ID and MALICIOUS_URL_HERE with the malicious URL):
1. {"title":"2025-12-17","data":{"files":[{"id":"ID_HERE","type":"image","url":"MALICIOUS_URL_HERE"}]},"access_control":{"read":{"group_ids":[],"user_ids":[]},"write":{"group_ids":[],"user_ids":[]}}}

Refresh page and notice the request being sent to the malicious URL
Share note and copy link

Step 5: View Note on Valid Account

Log into a valid account
Open the shared note
Notice the GET request sent to the malicious URL from the hidden image on the page

Step 6: Verify User Information Is Sent

Verify that user information is sent.

PoC (model)

Environment

• Open WebUI latest version (v0.6.41)

• Admin user

Step 1: Create a Malicious Link

• Set up a server to obtain victim's cookies, ip, referer, use-agent, etc

Step 2: Create Model

Navigate to /workspace/models
Create or edit a model
Send a POST request to /api/v1/models/create or /api/v1/models/model/update?id=[model_id]
Change the profile_image_url to the malicious link
Example parameters:
{"id":"model_test","base_model_id":"redacted","name":"MODEL_TEST","meta":{"profile_image_url":"MALICIOUS_URL_HERE","description":null,"suggestion_prompts":null,"tags":[],"capabilities":{"vision":true,"file_upload":true,"web_search":true,"image_generation":true,"code_interpreter":true,"citations":true,"usage":false}},"params":{},"access_control":null}

Step 3: View Image on Valid Account

Log into a valid account
Create chat with the model
Notice a GET request is sent to the malicious url
All users starting a chat with that model will be vulnerable to the attack

Step 4: View Image on Admin Account

Navigate to /workspace/models
Notice GET request sent to malicious url

Step 5: Verify User Information Is Sent

On the set up server verify that improperly set cookies are sent, IP, user-agent, etc.

Other Attack Examples

Alternative malicious links
Signout of Open WebUI
- /api/v1/auths/signout
Internal network endpoints
Signout of other applications
Resource intensive endpoints
Etc

Recommended Fix

Store images
Instead of sending a GET request to load the image each time, store the image and render on the page
Validate input
Image file types should be whitelisted (examples: .jpg, .png, .gif, .jpeg, etc)

Impact

Vulnerability Type

CWE-352: Cross-Site Request Forgery (CSRF)
CWE-20: Improper Input Validation

Affected users

All authenticated users

The impact of this vulnerability is significant. This application-wide vulnerability allows an attacker to perform actions on behalf of any user who views the compromised image. This can be particularly damaging if an administrator or privileged user views the image, as it could lead to elevated access or sensitive data exposure.

Severity

4.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.9.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45317"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:18:42Z",
    "nvd_published_at": "2026-05-15T22:16:54Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAn application-wide Cross-Site Request Forgery (CSRF)\u00a0vulnerability was found Open-WebUl\u0027s image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this vulnerability, and any user who views the compromised image (e.g., a profile picture) will unknowingly send a GET request to the attacker-controlled URL. This can lead to cookie theft, denial of service (DoS), or other malicious actions.\n\n\n\nThis can be exploited in various locations, including:\n\n\u2022 Profile picture\n\n\u2022 Model picture\n\n\u2022 Hidden images in shared chats\n\n\u2022 Images within shared notes\n\n## Details\n\n### Vulnerable Code:\nThis appears to occur in most locations where images can be uploaded/rendered. Here are found sinks:\n\n**Profile Image in chat**\n\n\u2022 Note: rendering profile picture in chat\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/ProfileImage.svelte#L16Code\n\n**Profile Picture edit**\n\n\u2022 Note: Profile picture rendering in edit\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Settings/Account.svelte#L205\n\n**Profile Image Navbar**\n\n\u2022 Note: Profile picture rendering in navbar\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Navbar.svelte#L237\n\n**Profile Image UserList**\n\n\u2022 Note: rendering images in user list admin panel\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/admin/Users/UserList.svelte#L399\n\n**Images in chat**\n\n\u2022 Note: rendering images in chat\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/common/Image.svelte#L35\n\n**Image in chat**\n\n\u2022 Note: Image sent in chat\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/channel/Messages/Message.svelte#L192\n**Model image in chat**\n\n\u2022 Note: Model image rendering in chat\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Placeholder.svelte#L128\n\n**Model image in chat response**\n\n\u2022 Note: Model image rendering in the assistant response\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/ResponseMessage.svelte#L612\n\n**Model Image Admin settings**\n\n\u2022 Note: Model image rendering in the admin settings\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/admin/Settings/Models.svelte#L336\n\n**Model Image Workspace**\n\n\u2022 Note: Model image rendering in the workspace\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/workspace/Models.svelte#L336\n\n**Model Image Edit**\n\n\u2022 Note: Model image rendering in the edit modal\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/workspace/Models/ModelEditor.svelte#L407\n\n**Image in Notes**\n\n\u2022 Note: Image rendering in shared note\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/common/RichTextInput/Image/image.ts#L140\n\n\u2022 Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/UserMessage.svelte#L184\n\n**Root Cause**\n\n1. Insecure display of image\n\n\u2022 Application is sending a GET request to the unvalidated image url\n\n2. Lack of Input Validation\n\n\u2022 Image url is not validated for filetype\n\n\n\n## PoCs\n\n### PoC (profile picture)\n\n**Environment**\n\n\u2022 Open-WebUl latest version (v0.6.41)\n\n\u2022 Valid user\n\n**Step 1: Create a Malicious Link**\n\n\u2022 Set up a server to obtain victim\u0027s cookies, ip, referer, user-agent, etc\n\n**Step 2: Profile Image URL**\n\n1. Add user\n\n1. Change the profile image url parameter to the malicious URL (server was used for PoC)\n\n2. Example POST request:\n\n\u003cimg width=\"1245\" height=\"484\" alt=\"image\" src=\"https://github.com/user-attachments/assets/295f0ab0-fe41-4d50-9c38-cb8c51a3bca2\" /\u003e\n\n\n4. Repeat action\n\n    1. Repeat for userSignUp, updateUserProfile, and update\n\n**Step 3: View Image on Victim Admin Account**\n\n1. Log into an admin account\n\n2. Visit the admin panel (/admin/users/overview)\n\n3. Notice the GET request sent to the malicious URL\n\n**Step 4: Verify User Information Is Sent**\n\n1. Confirm user information is sent\n\n\u003cimg width=\"1280\" height=\"677\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cb2f4039-167f-43f4-bd37-ffaf4d476cee\" /\u003e\n\n\n### PoC (chat)\n\n**Environment**\n\n\u2022 Open-WebUl latest version (v0.6.41)\n\n\u2022 Valid user\n\n**Step 1: Create a Malicious Link**\n\n\u2022 Set up a server to obtain victim\u0027s cookies, ip, referer, use-agent, etc\n\n**Step 2: Start chat**\n\n1. Start chat\n\n1. Send a message\n\n2. Resend POST request\n\n1. Resend post request to this endpoint /api/v1/chats/[chat_id_here]\n\n2. Add in a file with type set to image and the url set to the malicious link\n\n3. Replace models/ids/malicious_url_here with what is applicable\n\n4. {\"chat\":{\"models\":[\"redacted\"],\"history\":{\"messages\":{\"id_here\":{\"id\":\"id_here\",\"parentId\":\"id_here\",\"childrenIds\":[\"id_here\"],\"role\":\"user\",\"content\":\"\",\"files\":[{\"type\":\"image\",\"url\":\"MALICIOUS_URL_HERE\"}],\"timestamp\":1765978991,\"models\":[\"redacted\"]}}},\"params\":{},\"files\":[]}}\n\n\u003cimg width=\"646\" height=\"593\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1273fe2b-3b3b-45dc-9c52-6811f7b18667\" /\u003e\n\n3. Share chat\n\n    1. Copy link to share the chat\n\n**Step 3: View Image on Victim Account**\n\n1. Log into a valid account\n\n2. Open the shared chat\n\n3. Notice the GET request sent to the malicious URL from the hidden image on the page\n\n\u003cimg width=\"1384\" height=\"500\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bd6e220d-e039-4916-9865-5ce9f0939951\" /\u003e\n\n\n**Step 4: Verify User Information Is Sent**\n\n1. Confirm user information is sent\n\n\u003cimg width=\"1480\" height=\"797\" alt=\"image\" src=\"https://github.com/user-attachments/assets/78374c2e-d9c6-476b-944d-1c8230398989\" /\u003e\n\n\n### PoC (notes)\n\n**Environment**\n\n\u2022 Open WebUI latest version (v0.6.41)\n\n\u2022 Valid user with access to notes\n\n**Step 1: Create a Malicious Link**\n\n\u2022 Set up a server to obtain victim\u0027s cookies, ip, referer, use-agent, etc\n\n**Step 2: Create Note**\n\n1. Resend POST request to /api/v1/notes/[note_id_here]/update\n\n2. Add in the malicious URL to a file\n\n3. Example parameters\n\n    1.\u00a0 (replace the ID_HERE with valid ID and MALICIOUS_URL_HERE with the malicious URL):\n\n    2. `{\"title\":\"2025-12-17\",\"data\":{\"files\":[{\"id\":\"ID_HERE\",\"type\":\"image\",\"url\":\"MALICIOUS_URL_HERE\"}]},\"access_control\":{\"read\":{\"group_ids\":[],\"user_ids\":[]},\"write\":{\"group_ids\":[],\"user_ids\":[]}}}`\n\n\u003cimg width=\"892\" height=\"662\" alt=\"image\" src=\"https://github.com/user-attachments/assets/325a9bfa-2fb3-45be-aeec-e5695085d7d0\" /\u003e\n\n4. Refresh page and notice the request being sent to the malicious URL\n\n5. Share note and copy link\n\n**Step 5: View Note on Valid Account**\n\n1. Log into a valid account\n\n2. Open the shared note\n\n3. Notice the GET request sent to the malicious URL from the hidden image on the page\n\n\u003cimg width=\"1597\" height=\"317\" alt=\"image\" src=\"https://github.com/user-attachments/assets/767d865b-04a0-42b9-82fc-122acb9cbf16\" /\u003e\n\n**Step 6: Verify User Information Is Sent**\n\n1. Verify that user information is sent.\n\n\u003cimg width=\"1997\" height=\"860\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b0ecab88-9830-4fb4-ac18-acda9eb44ff7\" /\u003e\n\n### PoC (model)\n\n**Environment**\n\n\u2022 Open WebUI latest version (v0.6.41)\n\n\u2022 Admin user\n\n**Step 1: Create a Malicious Link**\n\n\u2022 Set up a server to obtain victim\u0027s cookies, ip, referer, use-agent, etc\n\n**Step 2: Create Model**\n\n1. Navigate to /workspace/models\n\n2. Create or edit a model\n\n3. Send a POST request to /api/v1/models/create or /api/v1/models/model/update?id=[model_id]\n\n1. Change the profile_image_url to the malicious link\n\n2. Example parameters:\n\n3. `{\"id\":\"model_test\",\"base_model_id\":\"redacted\",\"name\":\"MODEL_TEST\",\"meta\":{\"profile_image_url\":\"MALICIOUS_URL_HERE\",\"description\":null,\"suggestion_prompts\":null,\"tags\":[],\"capabilities\":{\"vision\":true,\"file_upload\":true,\"web_search\":true,\"image_generation\":true,\"code_interpreter\":true,\"citations\":true,\"usage\":false}},\"params\":{},\"access_control\":null}`\n\u003cimg width=\"887\" height=\"618\" alt=\"image\" src=\"https://github.com/user-attachments/assets/749dac39-0b9d-4b7e-815d-fd6f3f7c57bd\" /\u003e\n\n\n**Step 3: View Image on Valid Account**\n\n1. Log into a valid account\n\n2. Create chat with the model\n\n3. Notice a GET request is sent to the malicious url\n\n4. All users starting a chat with that model will be vulnerable to the attack\n\n\u003cimg width=\"1852\" height=\"468\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ff69c0a2-326d-4b99-9d8c-a73d9aa0deff\" /\u003e\n\n\n**Step 4:\u00a0 View Image on Admin Account**\n\n1. Navigate to /workspace/models\n\n2. Notice GET request sent to malicious url\n\n\u003cimg width=\"1793\" height=\"482\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bda6e687-ccad-4914-a779-281dc67ffcfe\" /\u003e\n\n\n\n\n**Step 5: Verify User Information Is Sent**\n\n1. On the set up server verify that improperly set cookies are sent, IP, user-agent, etc.\n\n\u003cimg width=\"1687\" height=\"910\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c783ad50-6701-4df8-8beb-ba0957baa2d9\" /\u003e\n\n### Other Attack Examples\n\n- Alternative malicious links\n\n- Signout of Open WebUI\n\n    - /api/v1/auths/signout\n\n- Internal network endpoints\n\n- Signout of other applications\n\n- Resource intensive endpoints\n\n- Etc\n\n\n### Recommended Fix\n\n- Store images\n\n   - Instead of sending a GET request to load the image each time, store the image and render on the page\n\n- Validate input\n\n   - Image file types should be whitelisted (examples: .jpg, .png, .gif, .jpeg, etc)\n\n\n## Impact\n\n### Vulnerability Type\n\n- CWE-352: Cross-Site Request Forgery (CSRF)\n\n- CWE-20: Improper Input Validation\n\n### Affected users\n\n- All authenticated users\n\n\nThe impact of this vulnerability is significant. This application-wide vulnerability allows an attacker to perform actions on behalf of any user who views the compromised image. This can be particularly damaging if an administrator or privileged user views the image, as it could lead to elevated access or sensitive data exposure.",
  "id": "GHSA-j6w6-986j-2m2m",
  "modified": "2026-05-19T15:58:56Z",
  "published": "2026-05-14T20:18:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-j6w6-986j-2m2m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45317"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.9.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation"
}

GHSA-J6W7-V73W-6PW3

Vulnerability from github – Published: 2024-03-20 15:32 – Updated: 2024-03-20 15:32

Details

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site's user with the edit_posts capability into performing an action such as clicking on a link.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-1785"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-20T02:15:08Z",
    "severity": "MODERATE"
  },
  "details": "The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers to update the plugin\u0027s settings and inject malicious JavaScript via a forged request granted they can trick a site\u0027s user with the edit_posts capability into performing an action such as clicking on a link.",
  "id": "GHSA-j6w7-v73w-6pw3",
  "modified": "2024-03-20T15:32:25Z",
  "published": "2024-03-20T15:32:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1785"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3039978%40contests-from-rewards-fuel\u0026new=3039978%40contests-from-rewards-fuel\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/689f3667-2dda-40a8-8627-d38c6c6816fc?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J6WQ-57G5-J35C

Vulnerability from github – Published: 2023-11-10 00:30 – Updated: 2026-04-28 21:33

Details

Cross-Site Request Forgery (CSRF) vulnerability in Faraz Quazi Floating Action Button plugin <= 1.2.1 versions.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-31088"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-09T23:15:09Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Faraz Quazi Floating Action Button plugin \u003c=\u00a01.2.1 versions.",
  "id": "GHSA-j6wq-57g5-j35c",
  "modified": "2026-04-28T21:33:05Z",
  "published": "2023-11-10T00:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31088"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/floating-action-button/vulnerability/wordpress-floating-action-button-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/floating-action-button/wordpress-floating-action-button-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J6X9-WWRP-PRCF

Vulnerability from github – Published: 2024-11-19 18:31 – Updated: 2026-04-01 18:32

Details

Cross-Site Request Forgery (CSRF) vulnerability in Garmur While Loading allows Stored XSS.This issue affects While Loading: from n/a through 3.0.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-51635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-19T17:15:18Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Garmur While Loading allows Stored XSS.This issue affects While Loading: from n/a through 3.0.",
  "id": "GHSA-j6x9-wwrp-prcf",
  "modified": "2026-04-01T18:32:28Z",
  "published": "2024-11-19T18:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51635"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/while-it-is-loading/vulnerability/wordpress-while-loading-plugin-3-0-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/while-it-is-loading/wordpress-while-loading-plugin-3-0-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J6XF-R6HG-8FMR

Vulnerability from github – Published: 2022-05-17 05:11 – Updated: 2022-05-17 05:11

Details

Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-2305"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-04-25T10:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.",
  "id": "GHSA-j6xf-r6hg-8fmr",
  "modified": "2022-05-17T05:11:13Z",
  "published": "2022-05-17T05:11:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2305"
    },
    {
      "type": "WEB",
      "url": "http://cs.cybozu.co.jp/information/20130415up10.php"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN06251813/374951/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN06251813/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2013-000034"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-J6XX-F4PG-FP88

Vulnerability from github – Published: 2022-05-17 02:00 – Updated: 2022-05-17 02:00

Details

Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2011-1685"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-04-22T10:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack.",
  "id": "GHSA-j6xx-f4pg-fp88",
  "modified": "2022-05-17T02:00:08Z",
  "published": "2022-05-17T02:00:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1685"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=696795"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66791"
    },
    {
      "type": "WEB",
      "url": "http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/44189"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2011/dsa-2220"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/47383"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2011/1071"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-J72G-7Q8M-FX32

Vulnerability from github – Published: 2022-05-17 01:38 – Updated: 2022-05-17 01:38

Details

Cross-site request forgery (CSRF) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2012-5763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-02-20T12:09:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.",
  "id": "GHSA-j72g-7q8m-fx32",
  "modified": "2022-05-17T01:38:56Z",
  "published": "2022-05-17T01:38:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5763"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80205"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21624568"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-J72Q-WJR5-4WVR

Vulnerability from github – Published: 2025-11-13 12:31 – Updated: 2026-01-20 15:31

Details

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross Site Request Forgery.This issue affects WP Plugin Manager: from n/a through <= 1.4.7.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-64271"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-13T10:15:52Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross Site Request Forgery.This issue affects WP Plugin Manager: from n/a through \u003c= 1.4.7.",
  "id": "GHSA-j72q-wjr5-4wvr",
  "modified": "2026-01-20T15:31:55Z",
  "published": "2025-11-13T12:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64271"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/wp-plugin-manager/vulnerability/wordpress-wp-plugin-manager-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/wp-plugin-manager/vulnerability/wordpress-wp-plugin-manager-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J73J-W68P-35P7

Vulnerability from github – Published: 2022-05-17 05:43 – Updated: 2022-05-17 05:43

Details

Multiple cross-site request forgery (CSRF) vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that (1) change a PIN, (2) delete messages, (3) add a delivery address, or (4) change a delivery address.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2011-1104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-02-28T17:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that (1) change a PIN, (2) delete messages, (3) add a delivery address, or (4) change a delivery address.",
  "id": "GHSA-j73j-w68p-35p7",
  "modified": "2022-05-17T05:43:18Z",
  "published": "2022-05-17T05:43:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1104"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/43483"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/136612"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/46537"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2011/0476"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-J742-GW52-675P

Vulnerability from github – Published: 2022-05-17 01:33 – Updated: 2022-05-17 01:33

Details

Cross-site request forgery (CSRF) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-4050"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-11-08T04:47:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.",
  "id": "GHSA-j742-gw52-675p",
  "modified": "2022-05-17T01:33:31Z",
  "published": "2022-05-17T01:33:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4050"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86433"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21652988"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Mitigation MIT-4

Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

Mitigation

Implementation

Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

Mitigation

Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

Mitigation

Architecture and Design

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

Mitigation

Architecture and Design

Use the "double-submitted cookie" method as described by Felten and Zeller:
When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

Mitigation

Architecture and Design

Do not use the GET method for any request that triggers a state change.

Mitigation

Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)

An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.

CAPEC-462: Cross-Domain Search Timing

An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.

CAPEC-467: Cross Site Identification

An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).

CAPEC-62: Cross Site Request Forgery

An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

← Back to the CWE list