CVE-2020-12480 — Cross-Site Request Forgery in Play Framework

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 89.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Lightbend Play Framework
Timeline
PublishedAug 17
Latest updateAug 18

Description

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDlightbend/play_framework2.6.0 — 2.6.25+2

🔴Vulnerability Details

2
OSV
CSRF in Play Framework↗2020-08-18
▶
GHSA
CSRF in Play Framework↗2020-08-18
▶
CVE-2020-12480 — Cross-Site Request Forgery | cvebase