{"containers": {"cna": {"affected": [{"product": "playframework", "vendor": "playframework", "versions": [{"status": "affected", "version": "< 2.8.16"}]}], "descriptions": [{"lang": "en", "value": "Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by configuring its `DefaultHttpErrorHandler` to do so based on the application mode. In its Scala API Play also provides a static object `DefaultHttpErrorHandler` that is configured to always show verbose errors. This is used as a default value in some Play APIs, so it is possible to inadvertently use this version in production. It is also possible to improperly configure the `DefaultHttpErrorHandler` object instance as the injected error handler. Both of these situations could result in verbose errors displaying to users in a production application, which could expose sensitive information from the application. In particular, the constructor for `CORSFilter` and `apply` method for `CORSActionBuilder` use the static object `DefaultHttpErrorHandler` as a default value. This is patched in Play Framework 2.8.16. The `DefaultHttpErrorHandler` object has been changed to use the prod-mode behavior, and `DevHttpErrorHandler` has been introduced for the dev-mode behavior. A workaround is available. When constructing a `CORSFilter` or `CORSActionBuilder`, ensure that a properly-configured error handler is passed. Generally this should be done by using the `HttpErrorHandler` instance provided through dependency injection or through Play's `BuiltInComponents`. Ensure that the application is not using the `DefaultHttpErrorHandler` static object in any code that may be run in production."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "description": "CWE-209: Generation of Error Message Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-02T18:05:11", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/playframework/playframework/releases/tag/2.8.16"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/playframework/playframework/security/advisories/GHSA-p9p4-97g9-wcrh"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/playframework/playframework/pull/11305"}], "source": {"advisory": "GHSA-p9p4-97g9-wcrh", "discovery": "UNKNOWN"}, "title": "Dev error stack trace leaking into prod in Play Framework", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-31023", "STATE": "PUBLIC", "TITLE": "Dev error stack trace leaking into prod in Play Framework"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "playframework", "version": {"version_data": [{"version_value": "< 2.8.16"}]}}]}, "vendor_name": "playframework"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by configuring its `DefaultHttpErrorHandler` to do so based on the application mode. In its Scala API Play also provides a static object `DefaultHttpErrorHandler` that is configured to always show verbose errors. This is used as a default value in some Play APIs, so it is possible to inadvertently use this version in production. It is also possible to improperly configure the `DefaultHttpErrorHandler` object instance as the injected error handler. Both of these situations could result in verbose errors displaying to users in a production application, which could expose sensitive information from the application. In particular, the constructor for `CORSFilter` and `apply` method for `CORSActionBuilder` use the static object `DefaultHttpErrorHandler` as a default value. This is patched in Play Framework 2.8.16. The `DefaultHttpErrorHandler` object has been changed to use the prod-mode behavior, and `DevHttpErrorHandler` has been introduced for the dev-mode behavior. A workaround is available. When constructing a `CORSFilter` or `CORSActionBuilder`, ensure that a properly-configured error handler is passed. Generally this should be done by using the `HttpErrorHandler` instance provided through dependency injection or through Play's `BuiltInComponents`. Ensure that the application is not using the `DefaultHttpErrorHandler` static object in any code that may be run in production."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-209: Generation of Error Message Containing Sensitive Information"}]}]}, "references": {"reference_data": [{"name": "https://github.com/playframework/playframework/releases/tag/2.8.16", "refsource": "MISC", "url": "https://github.com/playframework/playframework/releases/tag/2.8.16"}, {"name": "https://github.com/playframework/playframework/security/advisories/GHSA-p9p4-97g9-wcrh", "refsource": "CONFIRM", "url": "https://github.com/playframework/playframework/security/advisories/GHSA-p9p4-97g9-wcrh"}, {"name": "https://github.com/playframework/playframework/pull/11305", "refsource": "MISC", "url": "https://github.com/playframework/playframework/pull/11305"}]}, "source": {"advisory": "GHSA-p9p4-97g9-wcrh", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-31023", "datePublished": "2022-06-02T18:05:11", "dateReserved": "2022-05-18T00:00:00", "dateUpdated": "2022-06-02T18:05:11", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lightbend:play_framework:*:*:*:*:*:*:*:*", "matchCriteriaId": "E641F3DB-3013-49F8-9E2E-082D808C9958", "versionEndExcluding": "2.8.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by configuring its `DefaultHttpErrorHandler` to do so based on the application mode. In its Scala API Play also provides a static object `DefaultHttpErrorHandler` that is configured to always show verbose errors. This is used as a default value in some Play APIs, so it is possible to inadvertently use this version in production. It is also possible to improperly configure the `DefaultHttpErrorHandler` object instance as the injected error handler. Both of these situations could result in verbose errors displaying to users in a production application, which could expose sensitive information from the application. In particular, the constructor for `CORSFilter` and `apply` method for `CORSActionBuilder` use the static object `DefaultHttpErrorHandler` as a default value. This is patched in Play Framework 2.8.16. The `DefaultHttpErrorHandler` object has been changed to use the prod-mode behavior, and `DevHttpErrorHandler` has been introduced for the dev-mode behavior. A workaround is available. When constructing a `CORSFilter` or `CORSActionBuilder`, ensure that a properly-configured error handler is passed. Generally this should be done by using the `HttpErrorHandler` instance provided through dependency injection or through Play's `BuiltInComponents`. Ensure that the application is not using the `DefaultHttpErrorHandler` static object in any code that may be run in production."}, {"lang": "es", "value": "Play Framework es un framework web para Java y Scala. Las versiones anteriores a 2.8.16 son vulnerables a una generaci\u00f3n de mensajes de error que contienen informaci\u00f3n confidencial. Play Framework, cuando es ejecutado en modo dev, muestra errores verbose para facilitar la depuraci\u00f3n, incluyendo un seguimiento de la pila de excepciones. Play hace esto configurando su \"DefaultHttpErrorHandler\" para que lo haga en funci\u00f3n del modo de aplicaci\u00f3n. En su API Scala, Play tambi\u00e9n proporciona un objeto est\u00e1tico \"DefaultHttpErrorHandler\" que est\u00e1 configurado para mostrar siempre los errores verbose. Esto es usado como valor por defecto en algunas APIs de Play, por lo que es posible usar inadvertidamente esta versi\u00f3n en producci\u00f3n. Tambi\u00e9n es posible configurar incorrectamente la instancia del objeto \"DefaultHttpErrorHandler\" como administrador de errores inyectado. Ambas situaciones podr\u00edan resultar en que sean mostrados errores verbales a usuarios en una aplicaci\u00f3n de producci\u00f3n, lo que podr\u00eda exponer informaci\u00f3n confidencial de la aplicaci\u00f3n. En concreto, el constructor de \"CORSFilter\" y el m\u00e9todo \"apply\" de \"CORSActionBuilder\" usan el objeto est\u00e1tico \"DefaultHttpErrorHandler\" como valor por defecto. Esto ha sido corregido en Play Framework versi\u00f3n 2.8.16. El objeto \"DefaultHttpErrorHandler\" ha sido cambiado para usar el comportamiento del modo prod, y ha sido introducido \"DevHttpErrorHandler\" para el comportamiento del modo dev. Se presenta una mitigaci\u00f3n disponible. Cuando construya un \"CORSFilter\" o un \"CORSActionBuilder\", aseg\u00farese de que es pasado un manejador de errores correctamente configurado. Generalmente, esto deber\u00eda hacerse al usar la instancia \"HttpErrorHandler\" proporcionada mediante la inyecci\u00f3n de dependencia o mediante \"BuiltInComponents\" de Play. Aseg\u00farese de que la aplicaci\u00f3n no usa el objeto est\u00e1tico \"DefaultHttpErrorHandler\" en ning\u00fan c\u00f3digo que pueda ejecutarse en producci\u00f3n"}], "id": "CVE-2022-31023", "lastModified": "2022-06-11T00:58:57.783", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-06-02T18:15:09.820", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/playframework/playframework/pull/11305"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/playframework/playframework/releases/tag/2.8.16"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/playframework/playframework/security/advisories/GHSA-p9p4-97g9-wcrh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}