GitHub Advisoryadvisory · Maven
GHSA-cf8j-64h9-6q58 CSRF in Play Framework
MEDIUM
Official page ↗
- Aliases
- CVE-2020-12480
- Ecosystem
- Maven
- Packages
- com.typesafe.play:play_2.12
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-352
- Reviewed
- 2020-08-18
Affected packages
• Maven com.typesafe.play:play_2.12: < 2.7.5 → fixed in 2.7.5
• Maven com.typesafe.play:play_2.12: >= 2.8.0, < 2.8.2 → fixed in 2.8.2
Description
In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.
Related
Alias · CVE (1)
- CVE-2020-12480 In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain… vulnerability
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-12480 advisory
- https://github.com/playframework/playframework/pull/10285 web
- https://github.com/playframework/playframework/commit/c82de44fc50b7c58c6e0580f1f67ff08aa7bd154 web
- https://github.com/playframework/playframework package
- https://www.playframework.com/security/vulnerability web
- https://www.playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypass web