CVE-2013-3300

Lift Sensitive Information Disclosure

4.0 MediumFix available

The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.

Exploit likelihood

1.48%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2013-3300
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-3300
Updated: 2026-11-02

EUVDEUVD-2022-4344 No score

Record: EUVD-2022-4344
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jf9v-fxfq-wm76 No score

Lift Sensitive Information Disclosure

Record: GHSA-jf9v-fxfq-wm76
Weakness: CWE-119
Updated: 2026-11-02

OSVGHSA-jf9v-fxfq-wm76 No score

Lift Sensitive Information Disclosure

Record: GHSA-jf9v-fxfq-wm76
Weakness: CWE-119
Updated: 2026-11-02

Affected products

liftweb lift

Affected packages

Affected packages
Package	Affected	Fixed
`net.liftweb:lift-webkit` Maven	before 2.5	2.5
`net.liftweb:lift-webkit_2.7.7` Maven	before 2.5	2.5
`net.liftweb:lift-webkit_2.8.0` Maven	before 2.5	2.5
`net.liftweb:lift-webkit_2.8.1` Maven	before 2.5	2.5
`net.liftweb:lift-webkit_2.8.2` Maven	before 2.5	2.5
`net.liftweb:lift-webkit_2.9.0` Maven	before 2.5	2.5
`net.liftweb:lift-webkit_2.9.0-1` Maven	before 2.5	2.5
`net.liftweb:lift-webkit_2.9.1` Maven	before 2.5	2.5
`net.liftweb:lift-webkit` Maven	All versions, plus listed versions 0.100.70.80.91.0 Show 18 moreShow less 1.0.11.0.21.0.31.1-M11.1-M31.1-M41.1-M51.1-M61.1-M71.1-M82.02.0-M12.0-M22.0-M32.0-M42.0-M52.0-RC12.0-RC2	None known
`net.liftweb:lift-webkit_2.7.7` Maven	All versions, plus listed versions 2.12.1-M12.1-RC12.1-RC22.1-RC3 Show 8 moreShow less 2.22.2-M12.2-RC12.2-RC22.2-RC32.2-RC42.2-RC52.2-RC6	None known

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`net.liftweb:lift-webkit_2.8.0` Maven	All versions, plus listed versions 2.12.1-M12.1-RC12.1-RC22.1-RC3 Show 21 moreShow less 2.22.2-M12.2-RC12.2-RC22.2-RC32.2-RC42.2-RC52.2-RC62.32.3-RC12.3-RC22.3-RC32.3-RC42.3-RC52.42.4-M12.4-M22.4-M32.4-M42.4-M52.4-RC1	None known
`net.liftweb:lift-webkit_2.8.1` Maven	All versions, plus listed versions 2.22.2-RC12.2-RC22.2-RC32.2-RC4 Show 16 moreShow less 2.2-RC52.2-RC62.32.3-M12.3-RC12.3-RC22.3-RC32.3-RC42.3-RC52.42.4-M12.4-M22.4-M32.4-M42.4-M52.4-RC1	None known
`net.liftweb:lift-webkit_2.8.2` Maven	All versions, plus listed versions 2.42.4-RC1	None known
`net.liftweb:lift-webkit_2.9.0` Maven	All versions, plus listed versions 2.42.4-M12.4-M22.4-M32.4-M42.4-M52.4-RC1	None known
`net.liftweb:lift-webkit_2.9.0-1` Maven	All versions, plus listed versions 2.42.4-M12.4-M22.4-M32.4-M42.4-M52.4-RC1	None known
`net.liftweb:lift-webkit_2.9.1` Maven	before 2.5, plus listed versions 2.42.4-M42.4-M52.4-RC12.5-M1 Show 9 moreShow less 2.5-M22.5-M32.5-M42.5-RC12.5-RC22.5-RC32.5-RC42.5-RC52.5-RC6	2.5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-3300 is a medium vulnerability (CVSS 4.0) in Liftweb Lift, published July 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in net.liftweb:lift-webkit 2.5.