CVE-2013-3300 Lift Sensitive Information Disclosure
MediumCVSS 4.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| net.liftweb/lift-webkit(Maven) | All versions | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 0.10 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 0.7 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 0.8 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 0.9 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.0 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.0.1 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.0.2 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.0.3 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.1-M1 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.1-M3 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.1-M4 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.1-M5 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.1-M6 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.1-M7 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 1.1-M8 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 2.0 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 2.0-M1 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 2.0-M2 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 2.0-M3 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 2.0-M4 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 2.0-M5 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 2.0-RC1 | No fix listed |
| net.liftweb/lift-webkit(Maven) | = 2.0-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | All versions | No fix listed |
Show 114 more
| Product | Affected versions | Fixed in |
|---|---|---|
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.1 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.1-M1 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.1-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.1-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.1-RC3 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.2 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.2-M1 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.2-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.2-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.2-RC3 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.2-RC4 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.2-RC5 | No fix listed |
| net.liftweb/lift-webkit_2.7.7(Maven) | = 2.2-RC6 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | All versions | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.1 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.1-M1 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.1-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.1-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.1-RC3 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.2 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.2-M1 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.2-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.2-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.2-RC3 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.2-RC4 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.2-RC5 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.2-RC6 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.3 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.3-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.3-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.3-RC3 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.3-RC4 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.3-RC5 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.4 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.4-M1 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.4-M2 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.4-M3 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.4-M4 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.4-M5 | No fix listed |
| net.liftweb/lift-webkit_2.8.0(Maven) | = 2.4-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | All versions | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.2 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.2-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.2-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.2-RC3 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.2-RC4 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.2-RC5 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.2-RC6 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.3 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.3-M1 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.3-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.3-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.3-RC3 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.3-RC4 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.3-RC5 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.4 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.4-M1 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.4-M2 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.4-M3 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.4-M4 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.4-M5 | No fix listed |
| net.liftweb/lift-webkit_2.8.1(Maven) | = 2.4-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.8.2(Maven) | All versions | No fix listed |
| net.liftweb/lift-webkit_2.8.2(Maven) | = 2.4 | No fix listed |
| net.liftweb/lift-webkit_2.8.2(Maven) | = 2.4-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.9.0(Maven) | All versions | No fix listed |
| net.liftweb/lift-webkit_2.9.0(Maven) | = 2.4 | No fix listed |
| net.liftweb/lift-webkit_2.9.0(Maven) | = 2.4-M1 | No fix listed |
| net.liftweb/lift-webkit_2.9.0(Maven) | = 2.4-M2 | No fix listed |
| net.liftweb/lift-webkit_2.9.0(Maven) | = 2.4-M3 | No fix listed |
| net.liftweb/lift-webkit_2.9.0(Maven) | = 2.4-M4 | No fix listed |
| net.liftweb/lift-webkit_2.9.0(Maven) | = 2.4-M5 | No fix listed |
| net.liftweb/lift-webkit_2.9.0(Maven) | = 2.4-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | All versions | No fix listed |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | = 2.4 | No fix listed |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | = 2.4-M1 | No fix listed |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | = 2.4-M2 | No fix listed |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | = 2.4-M3 | No fix listed |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | = 2.4-M4 | No fix listed |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | = 2.4-M5 | No fix listed |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | = 2.4-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | < 2.5 | 2.5 |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.4 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.4-M4 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.4-M5 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.4-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-M1 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-M2 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-M3 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-M4 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-RC1 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-RC2 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-RC3 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-RC4 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-RC5 | No fix listed |
| net.liftweb/lift-webkit_2.9.1(Maven) | = 2.5-RC6 | No fix listed |
| liftweb lift | <= 2.5 | No fix listed |
| liftweb lift | = 2.1 | No fix listed |
| liftweb lift | = 2.2 | No fix listed |
| liftweb lift | = 2.3 | No fix listed |
| liftweb lift | = 2.4 | No fix listed |
| liftweb lift | = 2.5-m4 | No fix listed |
| liftweb lift | = 2.5-rc1 | No fix listed |
| liftweb lift | = 2.5-rc2 | No fix listed |
| liftweb lift | = 2.5-rc3 | No fix listed |
| liftweb lift | = 2.5-rc4 | No fix listed |
| liftweb lift | = 2.5-rc5 | No fix listed |
| net.liftweb/lift-webkit(Maven) | < 2.5 | 2.5 |
| net.liftweb/lift-webkit_2.7.7(Maven) | < 2.5 | 2.5 |
| net.liftweb/lift-webkit_2.8.0(Maven) | < 2.5 | 2.5 |
| net.liftweb/lift-webkit_2.8.1(Maven) | < 2.5 | 2.5 |
| net.liftweb/lift-webkit_2.8.2(Maven) | < 2.5 | 2.5 |
| net.liftweb/lift-webkit_2.9.0(Maven) | < 2.5 | 2.5 |
| net.liftweb/lift-webkit_2.9.0-1(Maven) | < 2.5 | 2.5 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch
- github.com product
- blog.addepar.com exploit
- github.com