CVEvulnerability

CVE-2015-5236

7.5 HIGH Published 2022-07-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-345

Description

It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.

Affected configurations

• icedtea-web project icedtea-web

Related

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References