Homepage

com.typesafe.play:play_2.12@2.6.0-M5 vulnerabilities

  • latest version

    2.8.22

  • latest non vulnerable version

    2.8.22

  • first published

    8 years ago

  • latest version published

    1 years ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the com.typesafe.play:play_2.12 package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Information Exposure

    com.typesafe.play:play_2.12 is a library for building scalable web applications with Java and Scala.

    Affected versions of this package are vulnerable to Information Exposure due to the generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by configuring its DefaultHttpErrorHandler to do so based on the application mode. Its Scala API Play also provides a static object DefaultHttpErrorHandler configured to always show verbose errors. This is used as a default value in some Play APIs, so it is possible to inadvertently use this version in production. It is also possible to improperly configure the DefaultHttpErrorHandler object instance as the injected error handler. Both of these situations could result in verbose errors displayed to users in a production application, which could expose sensitive information from the application. In particular, the constructor for CORSFilter and apply method for CORSActionBuilder use the static object DefaultHttpErrorHandler as a default value.

    How to fix Information Exposure?

    Upgrade com.typesafe.play:play_2.12 to version 2.8.16 or higher.

    [,2.8.16)
    • M
    Security Bypass

    com.typesafe.play:play_2.12 is a library for building scalable web applications with Java and Scala.

    Affected versions of this package are vulnerable to Security Bypass. In some situations, Play’s contentType.blackList for Cross-Site Request Forgery (CSRF) protection could be bypassed by sending a malformed Content-Type.

    How to fix Security Bypass?

    Upgrade com.typesafe.play:play_2.12 to version 2.7.5, 2.8.2 or higher.

    [2.6.0-M1,2.7.5)[2.8.0-M1,2.8.2)
    Go back to all versions of this package