NVD

Id
20105  
Name
CVE-2016-4464  
Description
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-09-21  
Modified Date
2016-11-28  
Seq
2016-4464  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
109707 20105 CVE-2016-4464 http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.asc  View
109708 20105 CVE-2016-4464 [oss-security] 20160908 New security advisory for Apache CXF Fediz - CVE-2016-4464  View
109709 20105 CVE-2016-4464 92905  View
109710 20105 CVE-2016-4464 https://git-wip-us.apache.org/repos/asf?p=cxf-fediz.git;a=commit;h=0006581e9cacbeef46381a223e5671e524d416b6  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
4064 JVNDB-2016-004837 Apache CXF Fediz のアプリケーションプラグインにおける制限を回避される脆弱性 Apache CXF Fediz のアプリケーションプラグインは、SAML AudienceRestriction の値と設定されている audience URI を一致させないため、制限を回避されるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2016-4464 90970 CVE-2016-4464 20105 7.5 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004837.html 2016-06-03 2016-09-26 View