GitHub Advisoryadvisory · Maven

GHSA-jf9v-fxfq-wm76 Lift Sensitive Information Disclosure

MEDIUM Published 2022-05-17 Modified 2025-09-30 Official page ↗
Aliases
CVE-2013-3300
Ecosystem
Maven
Packages
net.liftweb:lift-webkit, net.liftweb:lift-webkit_2.7.7, net.liftweb:lift-webkit_2.8.0, net.liftweb:lift-webkit_2.8.1, net.liftweb:lift-webkit_2.8.2, net.liftweb:lift-webkit_2.9.0, net.liftweb:lift-webkit_2.9.0-1, net.liftweb:lift-webkit_2.9.1
Severity
Moderate
Weaknesses
CWE-119
Reviewed
2023-08-29

Affected packages

• Maven net.liftweb:lift-webkit: < 2.5 (no fix yet) • Maven net.liftweb:lift-webkit_2.7.7: < 2.5 (no fix yet) • Maven net.liftweb:lift-webkit_2.8.0: < 2.5 (no fix yet) • Maven net.liftweb:lift-webkit_2.8.1: < 2.5 (no fix yet) • Maven net.liftweb:lift-webkit_2.8.2: < 2.5 (no fix yet) • Maven net.liftweb:lift-webkit_2.9.0: < 2.5 (no fix yet) • Maven net.liftweb:lift-webkit_2.9.0-1: < 2.5 (no fix yet) • Maven net.liftweb:lift-webkit_2.9.1: < 2.5 → fixed in 2.5

Description

The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.

Related

Alias · CVE (1)

  • CVE-2013-3300 The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References