| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jetty:jetty-server | ≥ 5.1.0, < 5.1.12≥ 6.0.0, < 6.0.2≥ 6.1.0pre1, < 6.1.0pre3< 4.2.27 | 5.1.126.0.26.1.0pre34.2.27 |
| jetty http server | = 4.2.11= 4.2.12= 4.2.14= 4.2.15= 4.2.16= 4.2.17= 4.2.18= 4.2.19= 4.2.24= 4.2.9= 5.1.11= 6.0.1= 6.1.0_pre2 |
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free