GHSA-cf8j-64h9-6q58

CSRF in Play Framework

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-12480

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.typesafe.play:play_2.12	< 2.7.5	2.7.5
Maven	com.typesafe.play:play_2.12	>= 2.8.0, < 2.8.2	2.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-12480 advisory
https://github.com/playframework/playframework/pull/10285 web
https://github.com/playframework/playframework/commit/c82de44fc50b7c58c6e0580f1f67ff08aa7bd154 web
https://github.com/playframework/playframework package
https://www.playframework.com/security/vulnerability web
https://www.playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypass web