CVE-2015-0201
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-254
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pivotal_software:spring_framework
- vmware:spring_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-45vg-2v73-vm62 | Maven | org.springframework:spring-core | >=4.1.0 <4.1.5 | 4.1.5 |