5.4
Medium
CVE-2024-10318 A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not…
Description
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NGINX OpenID Connect | Versions not published | |
| NGINX Instance Manager 2.5 | 2.5.0 → < 2.17.4 | 2.17.4 |
| NGINX API Connectivity Manager 1.0 | 1.0.0 → < 1.9.3 | 1.9.3 |
| NGINX Ingress Controller 1.0 | 1.0.0 → < 3.7.1 | 3.7.1 |
References
- my.f5.com my.f5.com
Timeline
- Published
- Last modified