CVE-2015-5175
HighSummary
Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
Risk Assessment
Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to downtime and loss of service availability.
Recommendation
It is recommended to upgrade to the latest version of Apache CXF Fediz to mitigate this vulnerability.
Other vulnerabilities in Apache CXF Fediz
See all- CVE-2017-7662High
A CSRF vulnerability has been identified in the OpenId Connect client registration service in Apache CXF Fediz prior to versions 1.4.0 and 1.3.2. A malicious web application could create new clients or reset secrets after an admin user has logged into the client registration service.
- CVE-2017-7661High
A CSRF vulnerability has been found in the Spring 2, Spring 3, Jetty 8, and Jetty 9 plugins in Apache CXF Fediz prior to versions 1.4.0, 1.3.2, and 1.2.4. This flaw may allow attackers to perform unauthorized actions on behalf of users.
- CVE-2016-4464Critical
The application plugins in Apache CXF Fediz versions 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to bypass intended restrictions via a crafted SAML token with a trusted signature.
Original NVD description (English source)
Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.