Description

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.

Remediation

References

CVE-2020-12480

Related Vulnerabilities

WordPress Plugin Mailster-Email Newsletter for WordPress Local File Inclusion (4.0.6)

Apache HTTP Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-9517)

Python Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2010-1450)

Joomla! Core 1.5.x Information Disclosure (1.5.0 - 1.5.12)

Squid Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2020-8450)

Severity

Medium

Classification

CVE-2020-12480 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities