CVE-2006-6969

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-07 · updated 2026-06-16

Description

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.

Affected products

Jetty Http Server: 4.2.9, 4.2.11, 4.2.12, 4.2.14, 4.2.15, 4.2.16 (+7)

References

http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
http://fisheye.codehaus.org/changelog/jetty/?cs=1274
http://osvdb.org/33108
http://secunia.com/advisories/24070
http://www.securityfocus.com/archive/1/459164/100/0/threaded
http://www.securityfocus.com/bid/22405
http://www.vupen.com/english/advisories/2007/0497
https://exchange.xforce.ibmcloud.com/vulnerabilities/32240
http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
http://fisheye.codehaus.org/changelog/jetty/?cs=1274
http://osvdb.org/33108
http://secunia.com/advisories/24070

Get alerted when CVE-2006-6969 or the next vulnerability affects your stack