Authorization Bypass

2019-05-0205:29:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

74.5%

JSON

icedtea-web is vulnerable to authorization bypass. It was discovered that IcedTea-Web did not properly determine an applet’s origin when asking the user if the applet should be run. A malicious page could use this flaw to cause IcedTea-Web to execute the applet without user approval, or confuse the user into approving applet execution based on an incorrectly indicated applet origin.

CPENameOperatorVersion
icedtea-webeq1.0.2__3.el6
icedtea-webeq1.4.1__0.el6
icedtea-webeq1.5.1__1.el6
icedtea-webeq1.1.4__1.el6
icedtea-webeq1.0.6__1.el6_1
icedtea-webeq1.2.3__4.el6_4
icedtea-webeq1.2.2__1.el6_3
icedtea-webeq1.2.2__3.el6
icedtea-webeq1.2.3__2.el6_4
icedtea-webeq1.0.4__2.el6_1

Name	Operator	Version
icedtea-web	eq	1.0.2__3.el6
icedtea-web	eq	1.4.1__0.el6
icedtea-web	eq	1.5.1__1.el6
icedtea-web	eq	1.1.4__1.el6
icedtea-web	eq	1.0.6__1.el6_1
icedtea-web	eq	1.2.3__4.el6_4
icedtea-web	eq	1.2.2__1.el6_3
icedtea-web	eq	1.2.2__3.el6
icedtea-web	eq	1.2.3__2.el6_4
icedtea-web	eq	1.0.4__2.el6_1