CSRF in Play Framework
In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-12480US | medium6.5 | — | ||
In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/playframework/playframeworkPACKAGE
- https://github.com/playframework/playframework/commit/c82de44fc50b7c58c6e0580f1f67ff08aa7bd154WEB
- https://github.com/playframework/playframework/pull/10285WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-12480ADVISORY
- https://www.playframework.com/security/vulnerabilityWEB
- https://www.playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypassWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan