CVE-2006-6969

🗓️ 07 Feb 2007 11:00:00Reported by mitreType

Jetty versions before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generate predictable session identifiers using java.util.random, making it vulnerable to brute force attacks and cross-site request forgery

Reporter	Title	Published	Views	Family All 8
Tenable Nessus	Jetty Non-random Session ID Vulnerability	6 Feb 200700:00	–	nessus
Cvelist	CVE-2006-6969	7 Feb 200711:00	–	cvelist
EUVD	EUVD-2022-4355	3 Oct 202520:07	–	euvd
Github Security Blog	Jetty Uses Predictable Session Identifiers	1 May 202207:43	–	github
NVD	CVE-2006-6969	7 Feb 200711:28	–	nvd
OSV	GHSA-JG2X-R643-W2CH Jetty Uses Predictable Session Identifiers	1 May 202207:43	–	osv
securityvulns	Jetty web server weak pseudo-random number generator	5 Feb 200700:00	–	securityvulns
SUSE CVE	SUSE CVE-2006-6969	20 Apr 202302:27	–	susecve

NVD

Node

jetty jetty_http_serverMatch4.2.9

jetty jetty_http_serverMatch4.2.11

jetty jetty_http_serverMatch4.2.12

jetty jetty_http_serverMatch4.2.14

jetty jetty_http_serverMatch4.2.15

jetty jetty_http_serverMatch4.2.16

jetty jetty_http_serverMatch4.2.17

jetty jetty_http_serverMatch4.2.18

jetty jetty_http_serverMatch4.2.19

jetty jetty_http_serverMatch4.2.24

jetty jetty_http_serverMatch5.1.11

jetty jetty_http_serverMatch6.0.1

jetty jetty_http_serverMatch6.1.0_pre2

Source	Link
vupen	www.vupen.com/english/advisories/2007/0497
securityfocus	www.securityfocus.com/archive/1/459164/100/0/threaded
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/32240
securityfocus	www.securityfocus.com/bid/22405
secunia	www.secunia.com/advisories/24070
archives	www.archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
osvdb	www.osvdb.org/33108
fisheye	www.fisheye.codehaus.org/changelog/jetty/

23 Apr 2026 00:35Current

7.1High risk

Vulners AI Score7.1

CVSS 26.8

EPSS0.00693