Lightbend Play Framework — known CVE vulnerabilities

Every CVE whose affected-product data names Lightbend Play Framework, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (11)

• CVE-2014-3630 — CVSS 9.8 (critical): XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow…
• CVE-2015-2156 — CVSS 7.5 (high): Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before…
• CVE-2018-13864 — CVSS 7.5 (high): A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when…
• CVE-2019-17598 — CVSS 7.5 (high): An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP…
• CVE-2020-26882 — CVSS 7.5 (high): In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.
• CVE-2020-26883 — CVSS 7.5 (high): In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.
• CVE-2020-27196 — CVSS 7.5 (high): An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given…
• CVE-2022-31018 — CVSS 7.5 (high): Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15…
• CVE-2020-12480 — CVSS 6.5 (medium): In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain…
• CVE-2022-31023 — CVSS 5.9 (medium): Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing…
• CVE-2020-28923 — CVSS 2.7 (low): An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data…