CVE-2020-28923

Description

An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON.

2.7

CVSS

Severity: Low

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.18%

Vendor Advisory playframework.com Vendor Advisory playframework.com

Affected: n/a n/a

References

Link	Tags
https://www.playframework.com/security/vulnerability	vendor advisory
https://www.playframework.com/security/vulnerability/CVE-2020-28923-ImproperRemovalofSensitiveInformationBeforeStorageorTransfer	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-28923?: CVE-2020-28923 has been scored as a low severity vulnerability.
How to fix CVE-2020-28923?: To fix CVE-2020-28923, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2020-28923 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2020-28923 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.