Vulnerability · Published Nov 6, 2024 · Assigned by f5
CVE-2024-10318NGINX OpenID Connect Vulnerability
Medium 5.4
In plain English
A medium-severity session fixation in NGINX API Connectivity Manager from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX OpenID Connect | fa1ad160e2637d1d583611124478039170d726ab – before 133504f4fd9f72f3e36668f9f2f3d32a86fcb269 |
| F5 | NGINX Instance Manager | 2.5.0 – before 2.17.4 |
| F5 | NGINX API Connectivity Manager | 1.0.0 – before 1.9.3 |
| F5 | NGINX Ingress Controller | 1.0.0 – before 3.7.1 |
Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- https://my.f5.com/manage/s/article/K000148232 vendor-advisory