CVE-2006-6969
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks,…
Does this matter?
Lower severity and a low EPSS score (1.61%). Track it; it rarely justifies an emergency change on its own.
Description
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.61% probability · 75th percentile
- CISA KEV
- Not listed
- Affected
- jetty/jetty http server
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
- http://fisheye.codehaus.org/changelog/jetty/?cs=1274
- http://osvdb.org/33108
- http://secunia.com/advisories/24070Vendor Advisory
- http://www.securityfocus.com/archive/1/459164/100/0/threaded
- http://www.securityfocus.com/bid/22405Vendor Advisory
- http://www.vupen.com/english/advisories/2007/0497
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32240
- http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
- http://fisheye.codehaus.org/changelog/jetty/?cs=1274
- http://osvdb.org/33108
- http://secunia.com/advisories/24070Vendor Advisory
- http://www.securityfocus.com/archive/1/459164/100/0/threaded
- http://www.securityfocus.com/bid/22405Vendor Advisory
- http://www.vupen.com/english/advisories/2007/0497
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32240
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.