CVE-2013-3300: The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a...

Security readout for executives and security teams

CVE-2013-3300 is a Lift framework JSON parsing flaw that could let a logged-in remote user see sensitive information from other users' sessions by sending malformed input containing a less-than character. The record does not provide CVSS scoring, but the impact is session data exposure. Exposure is most likely in older Scala applications using Lift before 2.5 and its JsonParser on authenticated web flows handling session-sensitive data. The source bundle does not identify specific downstream products, deployments, or package coordinates. Prioritize remediation for internet-facing or partner-facing applications still running Lift before 2.5, especially where sessions expose sensitive customer or financial data. Legacy internal-only systems are lower urgency but still need version confirmation. Mitigation focus: Upgrade Lift deployments to 2.5 or a later vendor-supported fixed release.; Verify the GitHub fix is included in any maintained fork or backport.; Restrict access to affected authenticated endpoints where upgrade is delayed..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.