CVE-2020-12480 - In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed

Back Back to CVE browser

MEDIUM

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed

Published Aug 17, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 0.53%

Description

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (6)

https://github.com/advisories/GHSA-cf8j-64h9-6q58
Advisory
https://github.com/playframework/playframework/commit/c82de44fc50b7c58c6e0580f1f67ff08aa7bd154
https://github.com/playframework/playframework/pull/10285
https://nvd.nist.gov/vuln/detail/CVE-2020-12480
https://www.playframework.com/security/vulnerability
x_refsource_MISCVendor Advisory
https://www.playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypass
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-cf8j-64h9-6q58		Advisory
https://github.com/playframework/playframework/commit/c82de44fc50b7c58c6e0580f1f67ff08aa7bd154
https://github.com/playframework/playframework/pull/10285
https://nvd.nist.gov/vuln/detail/CVE-2020-12480
https://www.playframework.com/security/vulnerability		x_refsource_MISCVendor Advisory
https://www.playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypass		x_refsource_MISCVendor Advisory