medium4.0
CVE-2013-3300
Lift Sensitive Information Disclosure
Impact
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | net.liftweb:lift-webkit | < 2.5 | none recorded |
| maven | net.liftweb:lift-webkit_2.7.7 | < 2.5 | none recorded |
| maven | net.liftweb:lift-webkit_2.8.0 | < 2.5 | none recorded |
| maven | net.liftweb:lift-webkit_2.8.1 | < 2.5 | none recorded |
| maven | net.liftweb:lift-webkit_2.8.2 | < 2.5 | none recorded |
| maven | net.liftweb:lift-webkit_2.9.0 | < 2.5 | none recorded |
| maven | net.liftweb:lift-webkit_2.9.0-1 | < 2.5 | none recorded |
| maven | net.liftweb:lift-webkit_2.9.1 | < 2.5 | 2.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liftweb | Lift | through 2.5 Versions 2.1, 2.2, 2.3, 2.4, 2.5 |