Description

An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON.

Remediation

References

CVE-2020-28923

Related Vulnerabilities

YUI Library Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4941)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-7168)

MySQL CVE-2019-2966 Vulnerability (CVE-2019-2966)

WordPress Plugin ZX_CSV Upload Multiple Vulnerabilities (1)

PHP Data Processing Errors Vulnerability (CVE-2015-4147)

Severity

Low

Classification

CVE-2020-28923 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities