Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

Cross-Site Request Forgery (CSRF) vulnerabilities

CWE-352 · 12 tracked

Cross-site request forgery (CWE-352) is a flaw where an application accepts a state-changing request without verifying it was intentionally sent by the user, letting an attacker trigger actions on the victim’s behalf.

How it’s exploited

The attacker gets a logged-in victim to load a page that silently submits a request (form or image tag) to the target app; because the browser attaches the session cookie automatically, the app treats it as legitimate.

How to prevent it

Anti-CSRF tokens on every state-changing request, SameSite cookies, and verifying the Origin/Referer for sensitive actions.

Tracked cross-site request forgery (csrf) vulnerabilities

12 CVEs in this class, each with severity, exploit status, EPSS, and remediation.

Frequently asked questions

What is Cross-Site Request Forgery (CSRF)?
Cross-site request forgery (CWE-352) is a flaw where an application accepts a state-changing request without verifying it was intentionally sent by the user, letting an attacker trigger actions on the victim’s behalf.
How is cross-site request forgery (csrf) exploited?
The attacker gets a logged-in victim to load a page that silently submits a request (form or image tag) to the target app; because the browser attaches the session cookie automatically, the app treats it as legitimate.
How do you prevent cross-site request forgery (csrf)?
Anti-CSRF tokens on every state-changing request, SameSite cookies, and verifying the Origin/Referer for sensitive actions.
How many cross-site request forgery (csrf) vulnerabilities are there?
O3 tracks 12 vulnerabilities classified as CWE-352 (Cross-Site Request Forgery (CSRF)), each with severity, exploit status, EPSS exploitation probability, and remediation. The full list is below.