CVE-2015-5236

7.5 highEPSS 0.8%

High (7.5) in icedtea-web project icedtea-web. EPSS 0.8% chance of exploitation in the next 30 days.

It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-345
Published: 2022-07-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

icedtea-web_project:icedtea-web

References

https://bugzilla.redhat.com/show_bug.cgi?id=1256403
https://bugzilla.redhat.com/show_bug.cgi?id=1256403

Check your stack JSON