Lucene search
MitreCVE-2013-3300HistoryJul 29, 2013 - 1:59 p.m.
CVE-2013-3300
2013-07-2913:59:05
CWE-119
mitre
web.nvd.nist.gov
20
lift
jsonparser
cve-2013-3300
security vulnerability
sensitive information
nvd
CVSS2
4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
AI Score
5.8
Confidence
Low
EPSS
0.001
Percentile
49.9%
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users’ sessions via invalid input data containing a < (less than) character.
Affected configurations
Node
liftwebliftRange≤2.5rc6
ORliftwebliftMatch2.1
ORliftwebliftMatch2.2
ORliftwebliftMatch2.3
ORliftwebliftMatch2.4
ORliftwebliftMatch2.5m4
ORliftwebliftMatch2.5rc1
ORliftwebliftMatch2.5rc2
ORliftwebliftMatch2.5rc3
ORliftwebliftMatch2.5rc4
ORliftwebliftMatch2.5rc5
| Vendor | Product | Version | CPE |
|---|---|---|---|
| liftweb | lift | * | cpe:2.3:a:liftweb:lift:*:rc6:*:*:*:*:*:* |
| liftweb | lift | 2.1 | cpe:2.3:a:liftweb:lift:2.1:*:*:*:*:*:*:* |
| liftweb | lift | 2.2 | cpe:2.3:a:liftweb:lift:2.2:*:*:*:*:*:*:* |
| liftweb | lift | 2.3 | cpe:2.3:a:liftweb:lift:2.3:*:*:*:*:*:*:* |
| liftweb | lift | 2.4 | cpe:2.3:a:liftweb:lift:2.4:*:*:*:*:*:*:* |
| liftweb | lift | 2.5 | cpe:2.3:a:liftweb:lift:2.5:m4:*:*:*:*:*:* |
| liftweb | lift | 2.5 | cpe:2.3:a:liftweb:lift:2.5:rc1:*:*:*:*:*:* |
| liftweb | lift | 2.5 | cpe:2.3:a:liftweb:lift:2.5:rc2:*:*:*:*:*:* |
| liftweb | lift | 2.5 | cpe:2.3:a:liftweb:lift:2.5:rc3:*:*:*:*:*:* |
| liftweb | lift | 2.5 | cpe:2.3:a:liftweb:lift:2.5:rc4:*:*:*:*:*:* |
Related
osv
osv
Lift Sensitive Information Disclosure
2022-05-17 05:07:19
nvd
nvd
CVE-2013-3300
2013-07-29 13:59:05
github
github
Lift Sensitive Information Disclosure
2022-05-17 05:07:19
cvelist
cvelist
CVE-2013-3300
2013-07-26 17:00:00
prion
prion
Authentication flaw
2013-07-29 13:59:00
CVSS2
4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
AI Score
5.8
Confidence
Low
EPSS
0.001
Percentile
49.9%
Related for CVE-2013-3300