PT-2017-5880 · Lightbend · Play

David Jorm · Publicado 2017-12-29 · Atualizado 2019-11-25 · CVE-2014-3630

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Play versions prior to 2.2.6 Play versions 2.3.x prior to 2.3.5

Description: The issue is related to an XML external entity (XXE) vulnerability in the Java XML processing functionality. This might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.

Recommendations: For Play versions prior to 2.2.6, update to version 2.2.6 or later. For Play versions 2.3.x prior to 2.3.5, update to version 2.3.5 or later.

Correção

DoS

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2014-3630

Produtos afetados

Play

Referências · 6

• https://groups.google.com/forum/#%21msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ · Nota
• https://groups.google.com/forum/#%21topic/play-framework/WdbFvemsFDQ · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3630 · Nota
• https://playframework.com/security/vulnerability/CVE-2014-3630-XmlExternalEntity · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3630 · Nota de Segurança
• https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf · Nota