CVE-2020-28923 — Improper Input Validation in Play Framework

CWE-20 — Improper Input Validation3 documents3 sources
Severity
2.7LOWNVD
EPSS
0.2%
top 60.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Lightbend Play Framework
Timeline
PublishedDec 3
Latest updateFeb 9

Description

An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NExploitability: 1.2 | Impact: 1.4

Affected Packages1 packages

▶NVDlightbend/play_framework2.8.0 — 2.8.4

🔴Vulnerability Details

2
OSV
Data Amplification in Play Framework↗2022-02-09
▶
GHSA
Data Amplification in Play Framework↗2022-02-09
▶
CVE-2020-28923 — Improper Input Validation | cvebase