Vulnerability CVE-2016-4464
Published: 2016-09-21

Description:
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Apache -> Cxf fediz 

 References:
http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.asc
http://www.openwall.com/lists/oss-security/2016/09/08/20
http://www.securityfocus.com/bid/92905
http://www.securitytracker.com/id/1036869
https://git-wip-us.apache.org/repos/asf?p=cxf-fediz.git;a=commit;h=0006581e9cacbeef46381a223e5671e524d416b6
Copyright 2024, cxsecurity.com

 

Back to Top