CWE · MITRE source
CWE-352Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (4)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
AT-2 | Literacy Training and Awareness | AT | Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF. |
IA-11 | Re-authentication | IA | Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation. |
PM-14 | Testing, Training, and Monitoring | PM | Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications. |
SI-4 | System Monitoring | SI | Detects anomalous request patterns consistent with cross-site request forgery. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2016-6277 KEV | 9.4 | 8.8 | 0.9431 | 2016-12-14 |
CVE-2018-7700 | 7.4 | 8.8 | 0.9324 | 2018-03-27 |
CVE-2022-1020 | 7.3 | 9.8 | 0.8953 | 2022-04-18 |
CVE-2022-0952 | 7.1 | 8.8 | 0.8822 | 2022-05-02 |
CVE-2021-25032 | 6.9 | 9.8 | 0.8189 | 2022-01-10 |
CVE-2019-9787 | 6.6 | 8.8 | 0.8102 | 2019-03-14 |
CVE-2022-1574 | 6.6 | 9.8 | 0.7686 | 2022-06-27 |
CVE-2020-5776 | 6.5 | 8.8 | 0.7879 | 2020-09-01 |
CVE-2014-100005 KEV | 6.4 | 8.0 | 0.4590 | 2015-01-13 |
CVE-2019-10655 | 6.3 | 9.8 | 0.7244 | 2019-03-30 |
CVE-2023-2533 KEV | 5.9 | 8.4 | 0.3632 | 2023-06-20 |
CVE-2018-4066 | 5.8 | 8.8 | 0.6766 | 2019-05-06 |
CVE-2022-41622 | 5.3 | 8.8 | 0.5977 | 2022-12-07 |
CVE-2020-10181 KEV | 5.2 | 9.8 | 0.2055 | 2020-03-11 |
CVE-2019-16667 | 5.1 | 8.8 | 0.5610 | 2019-09-26 |
CVE-2022-41924 | 5.1 | 9.6 | 0.5356 | 2022-11-23 |
CVE-2019-19833 | 5.0 | 6.5 | 0.6127 | 2019-12-18 |
CVE-2020-8417 | 4.8 | 8.8 | 0.5031 | 2020-01-28 |
CVE-2019-12616 | 4.6 | 6.5 | 0.5505 | 2019-06-05 |
CVE-2021-25052 | 4.3 | 8.8 | 0.4241 | 2022-01-10 |
CVE-2013-3568 | 4.2 | 8.8 | 0.4106 | 2020-02-06 |
CVE-2020-36836 | 4.2 | 8.0 | 0.4315 | 2024-10-16 |
CVE-2019-7262 | 4.1 | 8.8 | 0.3913 | 2019-07-02 |
CVE-2023-23897 | 3.9 | 4.3 | 0.5097 | 2023-07-10 |
CVE-2013-5696 | 3.8 | 0.0 | 0.6395 | 2013-09-23 |