CVE-2015-0201: Vulnerability in org.springframework:spring-core
Summary
CVE-2015-0201: Moderate severity vulnerability that affects org.springframework:spring-core. Affects org.springframework:spring-core versions >= 4.1.0, < 4.1.5. Fixed in 4.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.springframework:spring-core package is a core component of the Spring Framework, a popular Java application framework used for building enterprise-level applications. It provides essential functionality for dependency injection, inversion of control, and other features that facilitate the development of robust and scalable applications.
Vulnerability Detail
The vulnerability identified as CVE-2015-0201 affects the Java SockJS client in Pivotal Spring Framework 4.1.x before version 4.1.5. It arises from the generation of predictable session ids, which can be exploited by remote attackers to send messages to other sessions through unspecified vectors. This can lead to unauthorized access and potential data leakage or manipulation.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in org.springframework:spring-core can be mitigated by upgrading to version 4.1.5 or later. It is crucial to promptly address this vulnerability to prevent potential unauthorized access and data manipulation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-core →
FAQ
The vulnerability allows remote attackers to send messages to other sessions, potentially leading to unauthorized access and data manipulation.
The vulnerability affects Pivotal Spring Framework 4.1.x versions prior to 4.1.5.
There are no known exploits available for this vulnerability at the moment.
Yes, upgrading to org.springframework:spring-core version 4.1.5 or later will fix this vulnerability.
Restarting the application is not explicitly mentioned as a requirement after applying the fix. However, it is recommended to follow best practices and restart the application to ensure all changes take effect.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-core.
