CVE-2016-4464
High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
- Record
CVE-2016-4464- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
- Record
CVE-2016-4464- Updated
- 2026-11-02
EUVDEUVD-2018-0667 No score
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
- Record
EUVD-2018-0667- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qpwj-mvv7-v3m9 No score
High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
- Record
GHSA-qpwj-mvv7-v3m9- Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
- Record
CVE-2016-4464- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-qpwj-mvv7-v3m9 No score
High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
- Record
GHSA-qpwj-mvv7-v3m9- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVMGASA-2016-0243 No score
Updated xerces-c packages fix security vulnerability
The Xerces-C XML parser fails to successfully parse a DTD that is deeply nested, and this causes a stack overflow, which makes a denial of service attack against many applications possible by an unauthenticated attacker (CVE-2016-4464).
- Record
MGASA-2016-0243- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf.fediz:fediz-springMaven |
1.2.0 up to 1.2.3 | 1.2.3 |
org.apache.cxf.fediz:fediz-springMaven |
1.3.0 to 1.3.0 | 1.3.1 |
org.apache.cxf.fediz:fediz-spring2Maven |
1.2.0 up to 1.2.3 | 1.2.3 |
org.apache.cxf.fediz:fediz-spring2Maven |
1.3.0 to 1.3.0 | 1.3.1 |
org.apache.cxf.fediz:fediz-springMaven |
1.2.0 up to 1.2.3, plus listed versions 1.2.11.2.2 |
1.2.3 |
org.apache.cxf.fediz:fediz-springMaven |
1.3.0 up to 1.3.1 | 1.3.1 |
org.apache.cxf.fediz:fediz-spring2Maven |
1.2.0 up to 1.2.3, plus listed versions 1.2.11.2.2 |
1.2.3 |
org.apache.cxf.fediz:fediz-spring2Maven |
1.3.0 up to 1.3.1 | 1.3.1 |
xerces-cMageia:5 |
before 3.1.2-1.3.mga5 | 3.1.2-1.3.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-4464 is a critical vulnerability (CVSS 9.8) in Apache Cxf Fediz, published July 5, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.48%, the 93rd percentile. Fixed in org.apache.cxf.fediz:fediz-spring 1.2.3.
References
securitytracker.com/id/1036869
cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.asc
securityfocus.com/bid/92905
openwall.com/lists/oss-security/2016/09/08/20
git-wip-us.apache.org/repos/asf?p=cxf-fediz.git%3Ba=commit%3Bh=0006581e9cacbeef46381a223e5671e524d416b6
lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
Show 17 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-4464
github.com/advisories/GHSA-qpwj-mvv7-v3m9
advisories.mageia.org/MGASA-2016-0243.html
bugs.mageia.org/show_bug.cgi?id=18818
xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt