CVE-2006-6969
Medium
Description
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Jetty Http Server
PublishedFeb 7, 2007
First seenFeb 7, 2007
How to fix
Update
- org.eclipse.jetty:jetty-server4.2.27, 5.1.12, 6.0.2, 6.1.0pre3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jetty jetty_http_server | 4.2.9, 4.2.11, 4.2.12, 4.2.14, 4.2.15, 4.2.16, 4.2.17, 4.2.18, 4.2.19, 4.2.24, 5.1.11, 6.0.1, 6.1.0_pre2 | — |
| org.eclipse.jetty:jetty-serverMaven | v < 4.2.27, 5.1.0 ≤ v < 5.1.12, 6.0.0 ≤ v < 6.0.2, 6.1.0pre1 ≤ v < 6.1.0pre3 | 4.2.27, 5.1.12, 6.0.2, 6.1.0pre3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.