High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2

Also known as GHSA-qpwj-mvv7-v3m9

Published 10 y ago 2016-09-21 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

6.5%

percentile 94%

Public exploits

none known

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.

Exploit prediction (EPSS)

6.48% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.cxf.fediz:fediz-spring`	>=1.2.0, <1.2.3 >=1.3.0, <1.3.1	1.2.3 1.3.1
maven	`org.apache.cxf.fediz:fediz-spring2`	>=1.2.0, <1.2.3 >=1.3.0, <1.3.1	1.2.3 1.3.1

Classification

Weakness

CWE-284 Improper Access Control

References

securitytracker.com /id/1036869 · vdb-entry, x_refsource_SECTRACK, x_transferred
cxf.apache.org /security-advisories.data/CVE-2016-4464.txt.asc · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/92905 · vdb-entry, x_refsource_BID, x_transferred
openwall.com /lists/oss-security/2016/09/08/20 · mailing-list, x_refsource_MLIST, x_transferred
git-wip-us.apache.org /repos/asf?p=cxf-fediz.git%3Ba=commit%3Bh=0006581e9cacbeef46381a223e5671e524d416b6 · x_refsource_CONFIRM, x_transferred
lists.apache.org /thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.ap · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.ap · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.ap · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.ap · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.ap · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.ap · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-4464 · advisory
git-wip-us.apache.org /repos/asf?p=cxf-fediz.git;a=commit;h=0006581e9cacbeef46381a223e5671e524d416b6 · web
github.com /advisories/GHSA-qpwj-mvv7-v3m9 · advisory
lists.apache.org /thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apac · web
lists.apache.org /thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apac · web
lists.apache.org /thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apac · web
lists.apache.org /thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apac · web
lists.apache.org /thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apac · web
lists.apache.org /thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apac · web

Sources

CVE List: CVE-2016-4464
GitHub Advisory: GHSA-qpwj-mvv7-v3m9
NVD: CVE-2016-4464

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.