CVE-2020-12480

—

CVSS 3.1

6.5 medium

EPSS

<1%p43

Published

Aug 17, 2020 (Aug 17, 2020)

Modified

Jun 17, 2026

Description

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.

Vendors: lightbend
Products: play framework
Weakness: CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.