CWE-352: Cross-Site Request Forgery (CSRF)

CompoundStableExploit Likelihood: Medium🏆 #5 in Top 25 (2024)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

View on MITRE
345Related CVEs
23.08Severity Score
Back to CWE Lookup

Technical Details

Structure
Composite
Vulnerability Mapping
ALLOWED

Applicable To

Languages
Not Language-Specific
Platforms

🏆 CWE Top 25 Historical Ranking

2023:#9
Score: 11.73
324 CVEs
2024:#5↑4
Score: 23.08
345 CVEs
Trend:Worsening (moved down 4 ranks)

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-352 trust boundary

MITRE identifies manual analysis, automated static analysis, dynamic analysis as applicable detection approaches. Use them to inventory state-changing handlers and prove each one validates an unforgeable request property before changing server state. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-352: detection methods and operational guidanceMITRE CWE

Layer token-based and browser-assisted CSRF defenses

Use maintained framework CSRF protection where available. Otherwise validate server-generated tokens on every state-changing request, use Fetch Metadata with an origin-check fallback, apply SameSite session cookies as defense in depth, and avoid state changes through GET requests.

Cross-Site Request Forgery Prevention Cheat SheetOWASP Foundation

Apply lessons from CVE-2023-2533 in PaperCut NG/MF

NVD maps CVE-2023-2533 to CWE-352; a cross-site request forgery condition could let an attacker alter security settings or execute code under specific deployment conditions. Use the case to verify that administrative state changes reject cross-origin requests even when a victim already has an authenticated browser session.

CVE-2023-2533 DetailNIST National Vulnerability Database

Prioritize CWE-352 using its 2025 CWE Top 25 evidence

CWE-352 ranked #3 in the 2025 CWE Top 25 with a score of 13.64. The ranking table recorded no mapped vulnerabilities in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software WeaknessesMITRE CWE

Verify that cross-origin requests cannot perform state changes

Inventory state-changing endpoints and test whether a page on another origin can submit each request while the browser supplies the victim's cookies or HTTP credentials. Exercise both GET and POST paths because changing the method to POST is not a CSRF defense. Confirm that requests with a missing or invalid anti-CSRF value are rejected before any state change occurs.

Testing for Cross Site Request ForgeryOWASP Foundation

Frequently Asked Questions

What is CWE-352: Cross-Site Request Forgery (CSRF)?+

CWE-352: Cross-Site Request Forgery (CSRF) is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Is CWE-352 in the CWE Top 25 Most Dangerous Software Weaknesses?+

Yes. CWE-352 ranked #5 in the CWE Top 25 for 2024, associated with 345 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.

What are the security consequences of Cross-Site Request Forgery (CSRF)?+

If exploited, CWE-352 (Cross-Site Request Forgery (CSRF)) it can compromise Confidentiality, Integrity, Availability, Non-Repudiation and Access Control, leading to outcomes such as Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data and DoS: Crash, Exit, or Restart.

How do you prevent or mitigate Cross-Site Request Forgery (CSRF)?+

Recommended mitigations for CWE-352 include: Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script. Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332] Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

How is Cross-Site Request Forgery (CSRF) detected?+

CWE-352 can be detected using Automated Static Analysis, Automated Static Analysis - Binary or Bytecode, Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation and Manual Static Analysis - Source Code. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Cross-Site Request Forgery (CSRF)?+

CWE-352 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Cross-Site Request Forgery (CSRF)?+

MITRE documents real CVEs mapped to CWE-352, including CVE-2004-1703, CVE-2004-1995, CVE-2004-1967, CVE-2004-1842 and CVE-2005-1947. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-352 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Advertisement