CSRF in Play Framework · CVE-2020-12480 · GitHub Advisory Database · GitHub

CSRF in Play Framework

Moderate severity GitHub Reviewed Published Aug 18, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

com.typesafe.play:play_2.12 (Maven)

Affected versions

< 2.7.5

>= 2.8.0, < 2.8.2

Patched versions

2.7.5

2.8.2

Description

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.

References

Reviewed Aug 18, 2020

Published to the GitHub Advisory Database Aug 18, 2020

Last updated Jan 9, 2023

Severity

Moderate

6.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N