CVE-2016-4464

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.

• CWE-284

• http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.ascMitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/09/08/20Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/92905
• http://www.securitytracker.com/id/1036869
• https://git-wip-us.apache.org/repos/asf?p=cxf-fediz.git%3Ba=commit%3Bh=0006581e9cacbeef46381a223e5671e524d416b6
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E
• http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.ascMitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/09/08/20Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/92905
• http://www.securitytracker.com/id/1036869
• https://git-wip-us.apache.org/repos/asf?p=cxf-fediz.git%3Ba=commit%3Bh=0006581e9cacbeef46381a223e5671e524d416b6
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Published

Sep 21, 2016

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4458Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-4459Stack-based buffer overflow in native/mod_manager/node.c in …
• CVE-2016-4460Apache Pony Mail 0.6c through 0.8b allows remote attackers t…
• CVE-2016-4461Apache Struts 2.x before 2.3.29 allows remote attackers to e…
• CVE-2016-4462By manipulating the URL parameter externalLoginKey, a malici…
• CVE-2016-4463Stack-based buffer overflow in Apache Xerces-C++ before 3.1.…
• CVE-2016-4465The URLValidator class in Apache Struts 2 2.3.20 through 2.3…
• CVE-2016-4466Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-4467The C client and C-based client bindings in the Apache Qpid …
• CVE-2016-4468SQL injection vulnerability in Pivotal Cloud Foundry (PCF) b…
• CVE-2016-4469Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2016-4470The key_reject_and_link function in security/keys/key.c in t…