CVE-2015-0201

Moderate severity vulnerability that affects org.springframework:spring-core

5.0 MediumFix available

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

Exploit likelihood

1.90%Up 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

Record: CVE-2015-0201
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-254
Updated: 2026-11-02

CVE List No score

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

Record: CVE-2015-0201
Updated: 2026-11-02

EUVDEUVD-2018-0494 No score

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

Record: EUVD-2018-0494
Updated: 2026-11-03

GitHub AdvisoriesGHSA-45vg-2v73-vm62 No score

Moderate severity vulnerability that affects org.springframework:spring-core

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

Record: GHSA-45vg-2v73-vm62
Updated: 2026-11-02

OSVGHSA-45vg-2v73-vm62 No score

Moderate severity vulnerability that affects org.springframework:spring-core

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

Record: GHSA-45vg-2v73-vm62
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework:spring-core` Maven	4.1.0 up to 4.1.5	4.1.5
`org.springframework:spring-core` Maven	4.1.0 up to 4.1.5, plus listed versions 4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE	4.1.5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0201 is a medium vulnerability (CVSS 5.0) in Pivotal Software Spring Framework, published March 10, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in org.springframework:spring-core 4.1.5.

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References