Description
Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
Scores
CVSS v3
3.7
EPSS
0.0028
EPSS Percentile
51.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-338
Status
published
Products (4)
io.ratpack/ratpack-groovy
0 - 1.6.1Maven
io.ratpack/ratpack-java
0 - 1.6.1Maven
io.ratpack/ratpack-session
0 - 1.6.1Maven
ratpack_project/ratpack
< 1.6.1
Published
May 07, 2019
Tracked Since
Feb 18, 2026