VULNERABILITY INTELLIGENCE

CVE-2015-5235

CVSS score4.3 MEDIUM
EPSS probability3.02%
CISA KEVNot currently listed
Published2015-10-09
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N

Description

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references