Lucene search

GitHub Advisory DatabaseGHSA-CF8J-64H9-6Q58

HistoryAug 18, 2020 - 5:30 p.m.

CSRF in Play Framework

2020-08-1817:30:25

CWE-352

GitHub Advisory Database

github.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

21.6%

JSON

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can’t be parsed.

Affected configurations

Vulners

Node

com.typesafe.play\Matchplay_2.12

References

github.com/advisories/GHSA-cf8j-64h9-6q58

github.com/playframework/playframework/commit/c82de44fc50b7c58c6e0580f1f67ff08aa7bd154

github.com/playframework/playframework/pull/10285

nvd.nist.gov/vuln/detail/CVE-2020-12480

www.playframework.com/security/vulnerability

www.playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypass

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

21.6%

JSON

Related for GHSA-CF8J-64H9-6Q58