CVE-2015-5236

{"id": "CVE-2015-5236", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-07-07T16:15:08.807", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256403", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-345"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value."}, {"lang": "es", "value": "Se ha detectado que IcedTea-Web usaba el atributo codebase de la etiqueta (applet) en la p\u00e1gina HTML que aloja el applet de Java en las comprobaciones de la pol\u00edtica de mismo origen (SOP). Como la base de c\u00f3digo especificada no debe coincidir con el origen real del applet, esto permit\u00eda a un sitio malicioso omitir la SOP por medio de un valor de base de c\u00f3digo falsificado"}], "lastModified": "2022-07-15T16:09:22.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:icedtea-web_project:icedtea-web:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81A1AF11-67C4-4974-A0C3-333AAB1F51DC"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}