PT-2017-5880 · Lightbend · Play

David Jorm · Published 2017-12-29 · Updated 2019-11-25 · CVE-2014-3630

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Play versions prior to 2.2.6 Play versions 2.3.x prior to 2.3.5

Description: The issue is related to an XML external entity (XXE) vulnerability in the Java XML processing functionality. This might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.

Recommendations: For Play versions prior to 2.2.6, update to version 2.2.6 or later. For Play versions 2.3.x prior to 2.3.5, update to version 2.3.5 or later.

Fix

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2014-3630

Affected Products

Play

References · 6

• https://playframework.com/security/vulnerability/CVE-2014-3630-XmlExternalEntity · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3630 · Security Note
• https://groups.google.com/forum/#%21msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ · Note
• https://groups.google.com/forum/#%21topic/play-framework/WdbFvemsFDQ · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3630 · Note
• https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf · Note