Common Weakness Enumeration

    CWE Definition / CWE-352

    CWE-352: Cross-Site Request Forgery (CSRF)

    The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:11 Dec 2025

    Related Weakness

    CWE-345: Insufficient Verification of Data Authenticity

    CWE-345: Insufficient Verification of Data Authenticity

    CWE-346: Origin Validation Error

    CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')

    CWE-642: External Control of Critical State Data

    CWE-613: Insufficient Session Expiration