GHSA-jf9v-fxfq-wm76
Lift Sensitive Information Disclosure
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | net.liftweb:lift-webkit | < 2.5 | no fix listed |
| Maven | net.liftweb:lift-webkit_2.7.7 | < 2.5 | no fix listed |
| Maven | net.liftweb:lift-webkit_2.8.0 | < 2.5 | no fix listed |
| Maven | net.liftweb:lift-webkit_2.8.1 | < 2.5 | no fix listed |
| Maven | net.liftweb:lift-webkit_2.8.2 | < 2.5 | no fix listed |
| Maven | net.liftweb:lift-webkit_2.9.0 | < 2.5 | no fix listed |
| Maven | net.liftweb:lift-webkit_2.9.0-1 | < 2.5 | no fix listed |
| Maven | net.liftweb:lift-webkit_2.9.1 | < 2.5 | 2.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
References
External links from the advisory. They lead to third-party sites.