Lift

A Serious Vulnerability Security testing at a large Lift-powered site revealed a serious XML-related security vulnerability. The core issue is that Lift prior to recently patched versions 2.5.2, 2.6.1, and 3.0-M4 are vulnerable ... [More] to a XML eXternal Entity attack. The attack allows access to the local filesystem via XML entities: ]> The root cause of the problem is that Lift uses Scala's scala.xml.XML library for parsing and the default configuration of that library is insecure. [Less]