CVE-2015-5236

HIGH

IcedTea-Web - Same-Origin Policy Bypass via Spoofed Applet codebase

Title source: manual
STIX 2.1

Description

It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.

References (1)

Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1256403

Scores

CVSS v3 7.5
EPSS 0.0071
EPSS Percentile 48.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-345
Status published
Products (1)
icedtea-web_project/icedtea-web
Published Jul 07, 2022
Tracked Since Feb 18, 2026