medium6.8
CVE-2006-6969
Jetty Uses Predictable Session Identifiers
Impact
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.eclipse.jetty:jetty-server | < 4.2.27 | 4.2.27 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jetty | Jetty Http Server | Versions 4.2.9, 4.2.11, 4.2.12, 4.2.14, 4.2.15, 4.2.16 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
- http://fisheye.codehaus.org/changelog/jetty/?cs=1274
- http://osvdb.org/33108
- http://secunia.com/advisories/24070
- http://www.securityfocus.com/archive/1/459164/100/0/threaded
- http://www.securityfocus.com/bid/22405
- http://www.vupen.com/english/advisories/2007/0497
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32240
- https://github.com/advisories/GHSA-jg2x-r643-w2ch
- https://nvd.nist.gov/vuln/detail/CVE-2006-6969
- https://github.com/jetty-project/codehaus-jetty6/commit/36f81d2e7058b012f6718bc2f1e2786694a8a4a1
- https://github.com/jetty-project/codehaus-jetty6/commit/b31f606bf8058a38ab6253aa8dc2dfe6a7f83c78
- https://web.archive.org/web/20070208112816/http://fisheye.codehaus.org/changelog/jetty/?cs=1274
- https://web.archive.org/web/20070602184857/http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
- https://web.archive.org/web/20121019131825/http://www.securityfocus.com/archive/1/459164/100/0/threaded
- https://web.archive.org/web/20200228100052/http://www.securityfocus.com/bid/22405