Detections
Analytics

SCA: security update for com.typesafe.play:play_2.12, com.typesafe.play:play_2.13 (GHSA-p9p4-97g9-wcrh)

high Tenable Cloud Security Plugin ID 417428

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation
 of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose
 errors for easy debugging, including an exception stack trace. Play does this by configuring its
 `DefaultHttpErrorHandler` to do so based on the application mode. In its Scala API Play also provides a
 static object `DefaultHttpErrorHandler` that is configured to always show verbose errors. This is used as
 a default value in some Play APIs, so it is possible to inadvertently use this version in production. It
 is also possible to improperly configure the `DefaultHttpErrorHandler` object instance as the injected
 error handler. Both of these situations could result in verbose errors displaying to users in a production
 application, which could expose sensitive information from the application. In particular, the constructor
 for `CORSFilter` and `apply` method for `CORSActionBuilder` use the static object
 `DefaultHttpErrorHandler` as a default value. This is patched in Play Framework 2.8.16. The
 `DefaultHttpErrorHandler` object has been changed to use the prod-mode behavior, and `DevHttpErrorHandler`
 has been introduced for the dev-mode behavior. A workaround is available. When constructing a `CORSFilter`
 or `CORSActionBuilder`, ensure that a properly-configured error handler is passed. Generally this should
 be done by using the `HttpErrorHandler` instance provided through dependency injection or through Play's
 `BuiltInComponents`. Ensure that the application is not using the `DefaultHttpErrorHandler` static object
 in any code that may be run in production. (CVE-2022-31023)

See Also

https://github.com/advisories/GHSA-p9p4-97g9-wcrh

Plugin Details

Severity: High

ID: 417428

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2022-31023

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/3/2022

Vulnerability Publication Date: 6/2/2022

Reference Information

CVE: CVE-2022-31023

cwe: CWE-209