// For flags

CVE-2019-17598

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.

Se descubrió un problema en Lightbend Play Framework versiones 2.5.x hasta la versión 2.6.23. Cuando es configurado para realizar peticiones utilizando un proxy HTTP autenticado, play-ws puede algunas veces, generalmente bajo una carga alta, cuando se conecta a un host de destino usando https, exponer las credenciales del proxy al host de destino.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-10-15 CVE Reserved
  • 2019-11-05 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-326: Inadequate Encryption Strength
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Lightbend
Search vendor "Lightbend"
 Play Framework
Search vendor "Lightbend" for product "Play Framework"
 >= 2.5.0 <= 2.5.19
Search vendor "Lightbend" for product "Play Framework" and version " >= 2.5.0 <= 2.5.19"
-
Affected
Lightbend
Search vendor "Lightbend"
 Play Framework
Search vendor "Lightbend" for product "Play Framework"
 >= 2.6.0 <= 2.6.23
Search vendor "Lightbend" for product "Play Framework" and version " >= 2.6.0 <= 2.6.23"
-
Affected