CVE-2006-6969: Jetty Uses Predictable Session Identifiers
(updated )
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
References
- exchange.xforce.ibmcloud.com/vulnerabilities/32240
- github.com/advisories/GHSA-jg2x-r643-w2ch
- github.com/jetty-project/codehaus-jetty6/commit/36f81d2e7058b012f6718bc2f1e2786694a8a4a1
- github.com/jetty-project/codehaus-jetty6/commit/b31f606bf8058a38ab6253aa8dc2dfe6a7f83c78
- nvd.nist.gov/vuln/detail/CVE-2006-6969
- web.archive.org/web/20070208112816/http://fisheye.codehaus.org/changelog/jetty/?cs=1274
- web.archive.org/web/20070602184857/http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
- web.archive.org/web/20121019131825/http://www.securityfocus.com/archive/1/459164/100/0/threaded
- web.archive.org/web/20200228100052/http://www.securityfocus.com/bid/22405
Code Behaviors & Features
Detect and mitigate CVE-2006-6969 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →