CVE-2013-3300

The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.

Score

CVSS 2.0 4.0 Medium

Status

Modified - cve@mitre.org

Published

2013-07-29

Last modified

2024-09-17

Weaknesses

CWE-119

Affected products

• Lift (Liftweb)

References

• http://blog.addepar.com/2013/07/an-atypical-web-vulnerability.html
• https://github.com/lift/framework/commit/099d9c86cf6d81f4953957add478ab699946e601