CVE-2006-6969
Description
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Risk Information
Base Score
4.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score
Exploitation Probability
0.667
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2006-6969 are fixed in Eclipse-jetty-server 4.2.27 | Windows |
| Vulnerabilities CVE-2006-6969 are fixed in Eclipse-jetty-server 5.1.12 | Windows |
| Vulnerabilities CVE-2006-6969 are fixed in Eclipse-jetty-server 6.0.2 | Windows |
| Vulnerabilities CVE-2006-6969 are fixed in Eclipse-jetty-server 6.1.0 | Windows |
| Vulnerabilities CVE-2006-6969 are fixed in Eclipse-jetty-server for Linux 4.2.27 | Linux |
| Vulnerabilities CVE-2006-6969 are fixed in Eclipse-jetty-server for Linux 5.1.12 | Linux |
| Vulnerabilities CVE-2006-6969 are fixed in Eclipse-jetty-server for Linux 6.0.2 | Linux |
| Vulnerabilities CVE-2006-6969 are fixed in Eclipse-jetty-server for Linux 6.1.0 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234