Description

An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON.

Remediation

References

CVE-2020-28923

Related Vulnerabilities

Apache Tomcat Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2005-4838)

WordPress Plugin Events Shortcodes For The Events Calendar Unspecified Vulnerability (1.7.2)

Apache Tomcat version older than 5.5.26

WordPress Plugin Syndication Links Cross-Site Scripting (1.0.2)

MySQL CVE-2019-2801 Vulnerability (CVE-2019-2801)

Severity

Low

Classification

CVE-2020-28923 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities