CVE-2020-28923: Data Amplification in Play Framework

February 9, 2022

An issue was discovered in Play Framework Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play that used the Play Java API to serialize classes with protected or private fields to JSON.

References

github.com/advisories/GHSA-v9mf-jgq3-c28h
nvd.nist.gov/vuln/detail/CVE-2020-28923
www.playframework.com/security/vulnerability
www.playframework.com/security/vulnerability/CVE-2020-28923-ImproperRemovalofSensitiveInformationBeforeStorageorTransfer

Code Behaviors & Features

Detect and mitigate CVE-2020-28923 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →