CVE-2015-5236

State: Published
Severity: Not scored
Published: Jul 7, 2022
Updated: Aug 6, 2024
Reserved: Jul 1, 2015

Description

It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.

Scores

The record has no CVSS score.

Weaknesses

CWE-345

Affected Products

Product	Versions
Icedtea-webn/a	UnkownAffected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1256403

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.