Vulnerability in Icedtea-Web Project
CVE-2015-5236
It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
EPSS: 0.008 (52.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Icedtea-web_project Icedtea-web
- N/a Icedtea-web — versions Unkown
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)
Frequently asked questions
- What is CVE-2015-5236?
- CVE-2015-5236 is a high-severity vulnerability in Icedtea-Web Project, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.5/10. Published 2022-07-07.
- How severe is CVE-2015-5236?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2015-5236 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.