CVE-2015-0201 Moderate severity vulnerability that affects org.springframework:spring-core
MediumCVSS 5.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | >= 4.1.0, < 4.1.5 | 4.1.5 |
| org.springframework/spring-core(Maven) | = 4.1.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.4.RELEASE | No fix listed |
| pivotal software spring framework | = 4.1.0 | No fix listed |
| VMware spring framework | = 4.1.1 | No fix listed |
| VMware spring framework | = 4.1.2 | No fix listed |
| VMware spring framework | = 4.1.3 | No fix listed |
| VMware spring framework | = 4.1.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com vendor-advisory
- github.com product
- pivotal.io vendor-advisory
- Debian Security Tracker CVE-2015-0201 vendor-advisory