CVE-2020-12480: 
Java vulnerability analysis and mitigation

CVE-2020-12480 affects Play Framework versions 2.6.0 through 2.8.1. The vulnerability was discovered in the CSRF filter functionality and was disclosed on August 10, 2020. The vulnerability allows attackers to bypass CSRF protection by making CORS simple requests with content types that contain parameters that can't be parsed (Vendor Advisory).

The vulnerability exists in Play's contentType.blackList for Cross-Site Request Forgery (CSRF) protection, which could be bypassed by sending a malformed Content-Type. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

This vulnerability only impacts Play applications that use Play's built-in CSRF filter and have configured a black list of Content-Types for CSRF protection. Applications using the default configuration, where all requests have CSRF protection applied regardless of content types, are not affected. If a black list is configured, malicious users may be able to perform CSRF attacks on the application (Vendor Advisory).

The vulnerability requires user interaction and can be exploited remotely without requiring privileges. The attack complexity is rated as low according to the CVSS metrics (NVD).

The vulnerability has been fixed in Play versions 2.8.2 and 2.7.5. There will not be a 2.6.x release with this fix since this version has reached end-of-support. Users are advised to upgrade to a patched version as soon as possible to avoid this security issue (Vendor Advisory).

The vulnerability was discovered and reported by Kevin Joensen from Doyensec (Vendor Advisory).