CVE-2016-4464 – org.apache.cxf.fediz:fediz-spring

Package

Manager: maven
Name: org.apache.cxf.fediz:fediz-spring
Vulnerable Version: >=1.2.0 <1.2.3 || =1.3.0 || >=1.3.0 <1.3.1

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.02058 pctl0.83206

Details

High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2 The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.

Metadata

Created: 2018-10-18T16:57:10Z
Modified: 2020-06-16T21:52:31Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-qpwj-mvv7-v3m9/GHSA-qpwj-mvv7-v3m9.json
CWE IDs: ["CWE-284"]
Alternative ID: GHSA-qpwj-mvv7-v3m9
Finding: F039
Auto approve: 1