Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2016-4464GHSA-QPWJ-MVV7-V3M9

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against c

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 1.2.3, 1.3.1
None on Exploit-DB, Metasploit or GitHub

Summary

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • n/a n/a

    Version range not reported

  • org.apache.cxf.fediz:fediz-springMaven

    From 1.2.0 · fixed in 1.2.3

  • org.apache.cxf.fediz:fediz-springMaven

    From 1.3.0 · fixed in 1.3.1

  • org.apache.cxf.fediz:fediz-spring2Maven

    From 1.2.0 · fixed in 1.2.3

  • org.apache.cxf.fediz:fediz-spring2Maven

    From 1.3.0 · fixed in 1.3.1

References 11

securitytracker.com

cxf.apache.org

securityfocus.com

openwall.com

git-wip-us.apache.org

lists.apache.org