{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15685?format=json","vulnerability_id":"VCID-y254-5dqg-c7bz","summary":"Jetty Uses Predictable Session Identifiers\nJetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.","aliases":[{"alias":"CVE-2006-6969"},{"alias":"GHSA-jg2x-r643-w2ch"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60631?format=json","purl":"pkg:maven/org.eclipse.jetty/jetty-server@4.2.27","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.eclipse.jetty/jetty-server@4.2.27"},{"url":"http://public2.vulnerablecode.io/api/packages/60632?format=json","purl":"pkg:maven/org.eclipse.jetty/jetty-server@5.1.12","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.eclipse.jetty/jetty-server@5.1.12"},{"url":"http://public2.vulnerablecode.io/api/packages/60633?format=json","purl":"pkg:maven/org.eclipse.jetty/jetty-server@6.0.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.eclipse.jetty/jetty-server@6.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/60634?format=json","purl":"pkg:maven/org.eclipse.jetty/jetty-server@6.1.0pre3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.eclipse.jetty/jetty-server@6.1.0pre3"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60628?format=json","purl":"pkg:maven/org.eclipse.jetty/jetty-server@5.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-y254-5dqg-c7bz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.eclipse.jetty/jetty-server@5.1.0"},{"url":"http://public2.vulnerablecode.io/api/packages/60629?format=json","purl":"pkg:maven/org.eclipse.jetty/jetty-server@6.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-y254-5dqg-c7bz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.eclipse.jetty/jetty-server@6.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/60630?format=json","purl":"pkg:maven/org.eclipse.jetty/jetty-server@6.1.0pre1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-y254-5dqg-c7bz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.eclipse.jetty/jetty-server@6.1.0pre1"}],"references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2006-6969","reference_id":"","reference_type":"","scores":[{"value":"0.00693","scoring_system":"epss","scoring_elements":"0.72185","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2006-6969"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/32240","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/32240"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/jetty-project/codehaus-jetty6","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/jetty-project/codehaus-jetty6"},{"reference_url":"https://github.com/jetty-project/codehaus-jetty6/commit/36f81d2e7058b012f6718bc2f1e2786694a8a4a1","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/jetty-project/codehaus-jetty6/commit/36f81d2e7058b012f6718bc2f1e2786694a8a4a1"},{"reference_url":"https://github.com/jetty-project/codehaus-jetty6/commit/b31f606bf8058a38ab6253aa8dc2dfe6a7f83c78","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/jetty-project/codehaus-jetty6/commit/b31f606bf8058a38ab6253aa8dc2dfe6a7f83c78"},{"reference_url":"https://web.archive.org/web/20070208112816/http://fisheye.codehaus.org/changelog/jetty/?cs=1274","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20070208112816/http://fisheye.codehaus.org/changelog/jetty/?cs=1274"},{"reference_url":"https://web.archive.org/web/20070602184857/http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20070602184857/http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html"},{"reference_url":"https://web.archive.org/web/20121019131825/http://www.securityfocus.com/archive/1/459164/100/0/threaded","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20121019131825/http://www.securityfocus.com/archive/1/459164/100/0/threaded"},{"reference_url":"https://web.archive.org/web/20200228100052/http://www.securityfocus.com/bid/22405","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20200228100052/http://www.securityfocus.com/bid/22405"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2006-6969","reference_id":"CVE-2006-6969","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-6969"},{"reference_url":"https://github.com/advisories/GHSA-jg2x-r643-w2ch","reference_id":"GHSA-jg2x-r643-w2ch","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jg2x-r643-w2ch"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":330,"name":"Use of Insufficiently Random Values","description":"The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers."}],"exploits":[],"severity_range_score":"4.0 - 6.9","exploitability":"0.5","weighted_severity":"6.2","risk_score":3.1,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y254-5dqg-c7bz"}