CVE-2016-4464

Name of the Vulnerable Software and Affected Versions Apache CXF Fediz versions 1.2.x through 1.2.2 Apache CXF Fediz versions 1.3.x through 1.3.0

Description The issue is related to the application plugins in Apache CXF Fediz, where SAML AudienceRestriction values are not properly matched against configured audience URIs. This could allow remote attackers to bypass intended restrictions by using a crafted SAML token with a trusted signature.

Recommendations For Apache CXF Fediz versions 1.2.x through 1.2.2, update to version 1.2.3 or later. For Apache CXF Fediz versions 1.3.x through 1.3.0, update to version 1.3.1 or later.