CVE-2014-3630: Lightbend Play Framework

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.

Affected products

• Lightbend Play Framework: version 2.2.0 only; version 2.2.1 only; version 2.2.2 only; version 2.3.0 only; version 2.3.1 only; version 2.3.2 only; …
• Playframework Play Framework: version 2.2.0 only; version 2.2.1 only; version 2.2.2 only; version 2.2.3 only; version 2.2.4 only; version 2.2.5 only

Published 2017-12-29. Last modified 2026-06-17.