QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2006-6969

Back to search

CVE-2006-6969

Published: Feb 7, 2007

Modified: Aug 7, 2024

PUBLISHED

Description

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.

VendorProductVersions

n/a

n/a

affected
n/a

References

24070
third-party-advisory
x_refsource_SECUNIA
ADV-2007-0497
vdb-entry
x_refsource_VUPEN
33108
vdb-entry
x_refsource_OSVDB
22405
vdb-entry
x_refsource_BID
20070206 Re: Jetty Session ID Prediction
mailing-list
x_refsource_BUGTRAQ
20070205 Jetty Session ID Prediction
mailing-list
x_refsource_BUGTRAQ

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now