PT-2020-13139 · Lightbend · Play Framework

Kevin Joensen · Published 2020-08-17 · Updated 2020-08-24 · CVE-2020-12480

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Play Framework versions 2.6.0 through 2.8.1

Description The issue allows the CSRF filter to be bypassed by making CORS simple requests with content types that contain parameters that cannot be parsed.

Recommendations For Play Framework versions 2.6.0 through 2.8.1, consider updating the CSRF filter configuration to handle unparseable content type parameters or restrict access to the affected CORS endpoints until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-12480

GHSA-CF8J-64H9-6Q58

Affected Products

Play Framework

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-12480 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12480 · Vendor Advisory
• https://playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypass · Vendor Advisory
• https://playframework.com/security/vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cf8j-64h9-6q58 · Vendor Advisory
• https://github.com/playframework/playframework/pull/10285 · Note
• https://github.com/playframework/playframework · Note
• https://github.com/playframework/playframework/commit/c82de44fc50b7c58c6e0580f1f67ff08aa7bd154 · Note