{"id":"CVE-2016-4464","aliases":["EUVD-2018-0667","GHSA-qpwj-mvv7-v3m9","MGASA-2016-0243"],"status":"published","title":"High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2","description":"The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06484,"percentile":0.93796,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2016-07-05T15:47:08Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring","fixed_in":["1.2.3","1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring2","fixed_in":["1.2.3","1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:5","package":"xerces-c","fixed_in":["3.1.2-1.3.mga5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"last_affected":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"last_affected":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}],"versions":["1.2.0","1.2.1","1.2.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}],"versions":["1.2.0","1.2.1","1.2.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf.fediz:fediz-spring2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"Mageia:5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-1.3.mga5"}]}]}],"products":[{"vendor":"apache","product":"cxf_fediz"}],"references":[{"url":"http://www.securitytracker.com/id/1036869","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.asc","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/92905","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/09/08/20","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://git-wip-us.apache.org/repos/asf?p=cxf-fediz.git%3Ba=commit%3Bh=0006581e9cacbeef46381a223e5671e524d416b6","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4464","tags":["advisory"]},{"url":"https://git-wip-us.apache.org/repos/asf?p=cxf-fediz.git;a=commit;h=0006581e9cacbeef46381a223e5671e524d416b6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qpwj-mvv7-v3m9","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0243.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18818","tags":["report"]},{"url":"http://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-4464","description":"The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.","status":"published","published":"2016-09-21T18:00:00Z","modified":"2024-08-06T00:32:25.478Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2018-0667","description":"The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.","status":"published","published":"2016-09-21T18:00:00Z","modified":"2024-08-06T00:32:25Z","updated_at":"2026-11-03T02:22:45.901874Z"}],"ghsa":[{"id":"GHSA-qpwj-mvv7-v3m9","title":"High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2","description":"The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.","status":"published","published":"2018-10-18T16:57:10Z","modified":"2023-02-01T05:04:03Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2016-4464","description":"The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.","status":"published","published":"2016-09-21T18:59:04.897Z","modified":"2026-06-17T00:47:36.397Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"CVE-2016-4464","description":"The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.","status":"published","published":"2016-09-21T18:59:04.897Z","modified":"2026-10-24T10:30:58.859144177Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"GHSA-qpwj-mvv7-v3m9","title":"High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2","description":"The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.","status":"published","published":"2018-10-18T16:57:10Z","modified":"2024-12-02T05:51:21.182845Z","cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"MGASA-2016-0243","title":"Updated xerces-c packages fix security vulnerability","description":"The Xerces-C XML parser fails to successfully parse a DTD that is deeply\nnested, and this causes a stack overflow, which makes a denial of service\nattack against many applications possible by an unauthenticated attacker\n(CVE-2016-4464).\n","status":"published","published":"2016-07-05T15:47:08Z","modified":"2026-04-16T06:26:00.241301767Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}