cve.bz

CVE-2020-28923

2.7 lowEPSS 1.0%

Low (2.7) in lightbend play framework. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in com.typesafe.play:play 2.8.5.

An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON.

Severity

CVSS 3.1

2.7 low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
EPSS
1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-v9mf-jgq3-c28hMavencom.typesafe.play:play>=2.8.0 <2.8.52.8.5

References

Check your stackJSON