5.4
Moyenne
CVE-2024-10318 A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not…
Description
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| NGINX OpenID Connect | Versions non publiées | |
| NGINX Instance Manager 2.5 | 2.5.0 → < 2.17.4 | 2.17.4 |
| NGINX API Connectivity Manager 1.0 | 1.0.0 → < 1.9.3 | 1.9.3 |
| NGINX Ingress Controller 1.0 | 1.0.0 → < 3.7.1 | 3.7.1 |
Références
- my.f5.com my.f5.com
Chronologie
- Publiée
- Dernière modification