{"id":"CVE-2015-0201","aliases":["EUVD-2018-0494","GHSA-45vg-2v73-vm62"],"status":"published","title":"Moderate severity vulnerability that affects org.springframework:spring-core","description":"The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.019,"percentile":0.79819,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-254"],"published":"2015-03-10T14:00:00Z","modified":"2026-06-17T00:19:42Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-core","fixed_in":["4.1.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.5"}]}],"versions":["4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE"]}],"products":[{"vendor":"pivotal_software","product":"spring_framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://pivotal.io/security/cve-2015-0201","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0201","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-45vg-2v73-vm62","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework/commit/d63cfc8eebc396be009e733a81ebb4c984811f6e","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/dc5b5ca8ee09c890352f89b2dae58bc0132d6545","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-0201","description":"The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.","status":"published","published":"2015-03-10T14:00:00Z","modified":"2024-08-06T04:03:10.677Z","updated_at":"2026-11-02T14:35:45.088047Z"}],"euvd":[{"id":"EUVD-2018-0494","description":"The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.","status":"published","published":"2015-03-10T14:00:00Z","modified":"2024-08-06T04:03:10Z","updated_at":"2026-11-03T02:22:20.481932Z"}],"ghsa":[{"id":"GHSA-45vg-2v73-vm62","title":"Moderate severity vulnerability that affects org.springframework:spring-core","description":"The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.","status":"published","published":"2018-10-17T20:28:20Z","modified":"2024-03-05T18:20:20Z","updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2015-0201","description":"The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.","status":"published","published":"2015-03-10T14:59:04.35Z","modified":"2026-06-17T00:19:42.59Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"GHSA-45vg-2v73-vm62","title":"Moderate severity vulnerability that affects org.springframework:spring-core","description":"The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.","status":"published","published":"2018-10-17T20:28:20Z","modified":"2024-12-02T05:51:24.734486Z","updated_at":"2026-11-02T15:46:36.434231Z"}]}}