Vulnerability Description
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cxf Fediz | 1.2.0 |
Related Weaknesses (CWE)
References
- http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.ascMitigationVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/09/08/20Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/92905
- http://www.securitytracker.com/id/1036869
- https://git-wip-us.apache.org/repos/asf?p=cxf-fediz.git%3Ba=commit%3Bh=0006581e9
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de10
- https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fd
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba7
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a7
- http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.ascMitigationVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/09/08/20Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/92905
- http://www.securitytracker.com/id/1036869
FAQ
What is CVE-2016-4464?
CVE-2016-4464 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers ...
How severe is CVE-2016-4464?
CVE-2016-4464 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-4464?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cxf Fediz.