CVE-2020-28923: Serializable Class Containing Sensitive Data

December 3, 2020 (updated December 7, 2020)

An issue was discovered in Play Framework Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play that used the Play Java API to serialize classes with protected or private fields to JSON.

References

nvd.nist.gov/vuln/detail/CVE-2020-28923
www.playframework.com/security/vulnerability

Code Behaviors & Features

Detect and mitigate CVE-2020-28923 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →