CVE-2013-3300
liftweb lift: no CVSS score yet. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in net.liftweb:lift-webkit_2.9.1 2.5.
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- liftweb:lift
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jf9v-fxfq-wm76 | Maven | net.liftweb:lift-webkit | all versions | no fix published |
| GHSA-jf9v-fxfq-wm76 | Maven | net.liftweb:lift-webkit_2.7.7 | all versions | no fix published |
| GHSA-jf9v-fxfq-wm76 | Maven | net.liftweb:lift-webkit_2.8.0 | all versions | no fix published |
| GHSA-jf9v-fxfq-wm76 | Maven | net.liftweb:lift-webkit_2.8.1 | all versions | no fix published |
| GHSA-jf9v-fxfq-wm76 | Maven | net.liftweb:lift-webkit_2.8.2 | all versions | no fix published |
| GHSA-jf9v-fxfq-wm76 | Maven | net.liftweb:lift-webkit_2.9.0 | all versions | no fix published |
| GHSA-jf9v-fxfq-wm76 | Maven | net.liftweb:lift-webkit_2.9.0-1 | all versions | no fix published |
| GHSA-jf9v-fxfq-wm76 | Maven | net.liftweb:lift-webkit_2.9.1 | <2.5 | 2.5 |