play framework vulnerabilities and fixes

Recent CVEs affecting play framework, with upgrade or downgrade steps. 12 tracked.

Also searched as: playframework.

play framework has 12 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 11. Most recent: 2022-06-02. Highest priority: CVE-2014-3630 (score 61/100).

• CVE-2022-31023 MEDIUM 5.9 UPGRADE Play Framework is a web framework for Java and Scala
• CVE-2022-31018 HIGH 7.5 UPGRADE Play Framework is a web framework for Java and Scala
• CVE-2020-2200 HIGH 8.8 UPGRADE Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenki
• CVE-2020-28923 LOW 2.7 UPGRADE An issue was discovered in Play Framework 2.8.0 through 2.8.4
• CVE-2020-27196 HIGH 7.5 UPGRADE An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2
• CVE-2020-26883 HIGH 7.5 UPGRADE In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsi
• CVE-2020-26882 HIGH 7.5 UPGRADE In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form
• CVE-2020-12480 MEDIUM 6.5 UPGRADE In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with con
• CVE-2019-17598 HIGH 7.5 UPGRADE An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23
• CVE-2018-13864 HIGH 7.5 UPGRADE A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2
• CVE-2015-2156 HIGH 7.5 UPGRADE DOWNGRADE Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5
• CVE-2014-3630 CRITICAL 9.8 DOWNGRADE DOWNGRADE XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.

FAQ

How do I fix play framework vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is play framework being exploited right now?

None of the tracked play framework CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which play framework CVE should I patch first?

CVE-2014-3630 currently ranks highest (61/100): XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3..

RSS feed for play framework · ← Back to latest CVEs