CVE-2015-0201: Medium severity vmware spring framework vulnerability
Published Mar 10, 2015
·Updated
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.
Affected Software
6 affected componentsFixes available
maven/org.springframework:spring-core>=4.1.0<4.1.5
4.1.5
Pivotal Software Spring Framework=4.1.0
VMware Spring Framework=4.1.1
VMware Spring Framework=4.1.2
VMware Spring Framework=4.1.3
VMware Spring Framework=4.1.4
Event History
Mar 10, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Oct 17, 2018
Advisory Published
via GitHub·08:28 PM
Frequently Asked Questions
1
What is the severity of CVE-2015-0201?
CVE-2015-0201 has been classified as a high severity vulnerability due to its potential exploitation by remote attackers.
2
How do I fix CVE-2015-0201?
To fix CVE-2015-0201, upgrade your Spring Framework to version 4.1.5 or later.
3
What impact does CVE-2015-0201 have on affected systems?
CVE-2015-0201 allows remote attackers to send messages to other sessions by exploiting predictable session IDs.
4
Which versions of Spring Framework are affected by CVE-2015-0201?
CVE-2015-0201 affects Spring Framework versions 4.1.0 to 4.1.4.
5
Is CVE-2015-0201 applicable to both Spring Core and Spring Framework?
CVE-2015-0201 specifically impacts the Java SockJS client in the Spring Framework, which includes Spring Core.