What is CVE-2015-0201?

CVE-2015-0201 is a vulnerability in Pivotal_software Spring_framework, classified under CWE-254. Published 2015-03-10.

Is CVE-2015-0201 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Pivotal_software Spring_framework

CVE-2015-0201

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

EPSS: 0.002 (39.7th percentile) — read the EPSS interpretation.

Affected products

Pivotal_software Spring_framework — versions 4.1.0
Vmware Spring_framework — versions 4.1.1, 4.1.2, 4.1.3
N/a — versions n/a

Weakness classification (CWE)

CWE-254

Public proof-of-concept exploits

ARPSyndicate/cvemon
RedHatProductSecurity/CVE-HOWTO

References

secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2015-0201?: CVE-2015-0201 is a vulnerability in Pivotal_software Spring_framework, classified under CWE-254. Published 2015-03-10.
Is CVE-2015-0201 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.