CVE-2020-28923: 
Java vulnerability analysis and mitigation

An issue was discovered in Play Framework versions 2.8.0 through 2.8.4, disclosed on November 9, 2020. The vulnerability relates to JSON handling in the Play Java API where carefully crafted JSON payloads sent as a form field could lead to Data Amplification. This specifically affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON (Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 2.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. The vendor provided a more detailed CVSS metric of 4.2 with the vector string AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:X/RL:O/RC:C. The issue specifically involves improper handling of JSON serialization of private and protected fields in the Java API (NVD, Vendor Advisory).

The vulnerability could lead to exposure of sensitive information through improper removal of sensitive data before storage or transfer. This particularly impacts organizations that have migrated from Play versions prior to 2.8.0 and use the Play Java API for JSON serialization of classes containing protected or private fields (Vendor Advisory).

The vulnerability requires high privileges to exploit and network access to the target system. While the attack complexity is considered low according to the NVD scoring, the vendor's assessment indicates high attack complexity. No user interaction is required to exploit this vulnerability (NVD).

The vulnerability has been fixed in Play Framework version 2.8.5. Users are advised to upgrade to this version or later to address the security issue (Vendor Advisory).