CVE-2006-6969 Jetty Uses Predictable Session Identifiers
MediumCVSS 6.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jetty http server | = 4.2.9 | No fix listed |
| jetty http server | = 4.2.11 | No fix listed |
| jetty http server | = 4.2.12 | No fix listed |
| jetty http server | = 4.2.14 | No fix listed |
| jetty http server | = 4.2.15 | No fix listed |
| jetty http server | = 4.2.16 | No fix listed |
| jetty http server | = 4.2.17 | No fix listed |
| jetty http server | = 4.2.18 | No fix listed |
| jetty http server | = 4.2.19 | No fix listed |
| jetty http server | = 4.2.24 | No fix listed |
| jetty http server | = 5.1.11 | No fix listed |
| jetty http server | = 6.0.1 | No fix listed |
| jetty http server | = 6.1.0_pre2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | < 4.2.27 | 4.2.27 |
| org.eclipse.jetty/jetty-server(Maven) | >= 5.1.0, < 5.1.12 | 5.1.12 |
| org.eclipse.jetty/jetty-server(Maven) | >= 6.0.0, < 6.0.2 | 6.0.2 |
| org.eclipse.jetty/jetty-server(Maven) | >= 6.1.0pre1, < 6.1.0pre3 | 6.1.0pre3 |
References
- 20070206 Re: Jetty Session ID Prediction mailing-list
- fisheye.codehaus.org
- 33108 vdb-entry
- 24070 third-party-advisory vendor-advisory
- 20070205 Jetty Session ID Prediction mailing-list
- 22405 vdb-entry vendor-advisory
- ADV-2007-0497 vdb-entry
- jetty-sessionid-session-hijacking(32240) vdb-entry
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com product
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- github.com