CVE-2013-3300

🗓️ 29 Jul 2013 13:59:05Reported by [email protected]Type

The JsonParser class in Lift before 2.5 interprets a certain end-index value as a length value, allowing remote authenticated users to obtain sensitive information from other users' sessions via invalid input data

Reporter	Title	Published	Views	Family All 17
CVE	CVE-2013-3300	26 Jul 201317:00	–	cve
Cvelist	CVE-2013-3300	26 Jul 201317:00	–	cvelist
EUVD	EUVD-2022-4344	3 Oct 202520:07	–	euvd
Github Security Blog	Lift Sensitive Information Disclosure	17 May 202205:07	–	github
OSV	GHSA-JF9V-FXFQ-WM76 Lift Sensitive Information Disclosure	17 May 202205:07	–	osv
Prion	Authentication flaw	29 Jul 201313:59	–	prion
RedhatCVE	CVE-2013-3300	22 May 202511:27	–	redhatcve
vulnersOsv	cc.co.scala-reactive:reactive-web_2.8.1 (=0.1), com.fmpwizard:lift-named-comet_2.8.1 (=0.3) +32 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit_2.8.1 (>=2.2 <=2.4-RC1)	17 May 202205:07	–	vulnersosv
vulnersOsv	com.sun.jersey.contribs:jersey-lift (>=1.1.5 <=1.19.4), com.sun.jersey.contribs:jersey-lift-test (>=1.1.5 <=1.19.4) +22 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit (>=1.0 <=1.1-M8)	17 May 202205:07	–	vulnersosv
vulnersOsv	com.fmpwizard:lift-named-comet_2.9.0-1 (=0.3), com.foursquare:rogue-lift_2.9.0-1 (>=2.0.0 <=2.3.0) +21 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit_2.9.0-1 (>=2.4 <=2.4-RC1)	17 May 202205:07	–	vulnersosv

NVD

Node

liftweb liftRange≤2.5rc6

liftweb liftMatch2.1

liftweb liftMatch2.2

liftweb liftMatch2.3

liftweb liftMatch2.4

liftweb liftMatch2.5m4

liftweb liftMatch2.5rc1

liftweb liftMatch2.5rc2

liftweb liftMatch2.5rc3

liftweb liftMatch2.5rc4

liftweb liftMatch2.5rc5

Source	Link
blog	www.blog.addepar.com/2013/07/an-atypical-web-vulnerability.html
github	www.github.com/lift/framework/commit/099d9c86cf6d81f4953957add478ab699946e601

29 Apr 2026 01:13Current

5.6Medium risk

Vulners AI Score5.6

CVSS 24

EPSS0.00161

CWE-119