Apache CXF Fediz vulnerabilities
4 known CVE vulnerabilities in Apache CXF Fediz, translated and rated.
- CVE-2015-5175High
Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
- CVE-2017-7662High
A CSRF vulnerability has been identified in the OpenId Connect client registration service in Apache CXF Fediz prior to versions 1.4.0 and 1.3.2. A malicious web application could create new clients or reset secrets after an admin user has logged into the client registration service.
- CVE-2017-7661High
A CSRF vulnerability has been found in the Spring 2, Spring 3, Jetty 8, and Jetty 9 plugins in Apache CXF Fediz prior to versions 1.4.0, 1.3.2, and 1.2.4. This flaw may allow attackers to perform unauthorized actions on behalf of users.
- CVE-2016-4464Critical
The application plugins in Apache CXF Fediz versions 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to bypass intended restrictions via a crafted SAML token with a trusted signature.