CVE-2015-5236
icedtea-web: SOP checks based on codebase and not applet origin
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · November 11, 2021
Updated · November 22, 2025
Description
A flaw was discovered that IcedTea-Web did not properly determine an applet's origin when performing same-origin checks. A malicious page could use this flaw to bypass the Same Origin Policy (SOP) and access data on unrelated sites using a spoofed value for the applet's codebase attribute.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-345 · Insufficient Verification of Data Authenticity