CVE-2015-0201

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

Score

CVSS 2.0 5.0 Medium

Status

Modified - secalert@redhat.com

Published

2015-03-10

Last modified

2024-08-06

Weaknesses

CWE-254

Affected products

• Spring Framework (Pivotal Software)
• Spring Framework (Vmware)

References

• https://pivotal.io/security/cve-2015-0201