Unscored severity · published Feb 7, 2007
CVE-2006-6969
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JH
Jetty Http Server · Jetty
4.2.9; 4.2.11; 4.2.12; 4.2.14; 4.2.15; 4.2.16; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-6969
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-6969
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
fisheye.codehaus.org
http://fisheye.codehaus.org/changelog/jetty/?cs=1274
osvdb.org
http://osvdb.org/33108
Vendor Advisory
http://secunia.com/advisories/24070
www.securityfocus.com
http://www.securityfocus.com/archive/1/459164/100/0/threaded
Vendor Advisory
http://www.securityfocus.com/bid/22405
More from Jetty Http Server
–
CVE-2004-2381
HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large…
–
CVE-2004-2478
Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner Interchange before 4.2.4, (2) CA Unicenter Web Services Distributed Management (WSDM) before…
–
CVE-2002-1178
Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0 allows remote attackers to execute arbitrary commands via ..\ (dot-dot backslash) sequences…