GoogleOSV:GHSA-JG2X-R643-W2CHJetty Uses Predictable Session Identifiers
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
References
exchange.xforce.ibmcloud.com/vulnerabilities/32240
github.com/jetty-project/codehaus-jetty6
github.com/jetty-project/codehaus-jetty6/commit/36f81d2e7058b012f6718bc2f1e2786694a8a4a1
github.com/jetty-project/codehaus-jetty6/commit/b31f606bf8058a38ab6253aa8dc2dfe6a7f83c78
nvd.nist.gov/vuln/detail/CVE-2006-6969
web.archive.org/web/20070208112816/fisheye.codehaus.org/changelog/jetty/?cs=1274
web.archive.org/web/20070602184857/archives.neohapsis.com/archives/bugtraq/2007-02/0070.html
web.archive.org/web/20121019131825/www.securityfocus.com/archive/1/459164/100/0/threaded
web.archive.org/web/20200228100052/www.securityfocus.com/bid/22405
Related
