GHSA-jf9v-fxfq-wm76Medium

Lift Sensitive Information Disclosure

Published
May 17, 2022
Last Modified
September 30, 2025

🔗 CVE IDs covered (1)

CVE-2013-3300 →

📋 Description

The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.

🎯 Affected products8

  • maven/net.liftweb:lift-webkit:< 2.5
  • maven/net.liftweb:lift-webkit_2.7.7:< 2.5
  • maven/net.liftweb:lift-webkit_2.8.0:< 2.5
  • maven/net.liftweb:lift-webkit_2.8.1:< 2.5
  • maven/net.liftweb:lift-webkit_2.8.2:< 2.5
  • maven/net.liftweb:lift-webkit_2.9.0:< 2.5
  • maven/net.liftweb:lift-webkit_2.9.0-1:< 2.5
  • maven/net.liftweb:lift-webkit_2.9.1:< 2.5

🔗 References (4)