VULNERABILITY INTELLIGENCE

CVE-2015-5236

CVSS score7.5 HIGH

EPSS probability0.83%

CISA KEVNot currently listed

Published2022-07-07

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.

Weakness classification

CWE-345: Insufficient Verification of Data Authenticity

Primary references

secalert@redhat.com — Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory