com.typesafe.play:play_2.12@2.6.25 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the com.typesafe.play:play_2.12 package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Information Exposure

com.typesafe.play:play_2.12 is a library for building scalable web applications with Java and Scala.

Affected versions of this package are vulnerable to Information Exposure due to the generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by configuring its DefaultHttpErrorHandler to do so based on the application mode. Its Scala API Play also provides a static object DefaultHttpErrorHandler configured to always show verbose errors. This is used as a default value in some Play APIs, so it is possible to inadvertently use this version in production. It is also possible to improperly configure the DefaultHttpErrorHandler object instance as the injected error handler. Both of these situations could result in verbose errors displayed to users in a production application, which could expose sensitive information from the application. In particular, the constructor for CORSFilter and apply method for CORSActionBuilder use the static object DefaultHttpErrorHandler as a default value.

How to fix Information Exposure?

Upgrade com.typesafe.play:play_2.12 to version 2.8.16 or higher.

[,2.8.16)
  • M
Security Bypass

com.typesafe.play:play_2.12 is a library for building scalable web applications with Java and Scala.

Affected versions of this package are vulnerable to Security Bypass. In some situations, Play’s contentType.blackList for Cross-Site Request Forgery (CSRF) protection could be bypassed by sending a malformed Content-Type.

How to fix Security Bypass?

Upgrade com.typesafe.play:play_2.12 to version 2.7.5, 2.8.2 or higher.

[2.6.0-M1,2.7.5) [2.8.0-M1,2.8.2)