CVE-2013-3300: Lift Sensitive Information Disclosure

May 17, 2022 (updated September 30, 2025)

The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users’ sessions via invalid input data containing a < (less than) character.

References

github.com/advisories/GHSA-jf9v-fxfq-wm76
github.com/lift/framework
github.com/lift/framework/commit/099d9c86cf6d81f4953957add478ab699946e601
nvd.nist.gov/vuln/detail/CVE-2013-3300

Code Behaviors & Features

Detect and mitigate CVE-2013-3300 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →