Description
In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.
Remediation
References
https://www.playframework.com/security/vulnerability
https://www.playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypass
Related Vulnerabilities
CVE-2020-7653 Vulnerability in npm package snyk-broker
CVE-2019-1003006 Vulnerability in maven package org.jenkins-ci.plugins:groovy
CVE-2015-5204 Vulnerability in npm package cordova-plugin-file-transfer
CVE-2022-40955 Vulnerability in maven package org.apache.inlong:sort-connector-mysql-cdc
CVE-2023-49803 Vulnerability in maven package org.webjars.npm:koa__cors