CVE-2024-10318

Published: Nov 6, 2024Modified: Jun 17, 2026

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: f5sirt@f5.com (Secondary)

Description

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.

Affected (6)

Products: F5: Nginx Api Connectivity Manager, Nginx Ingress Controller, Nginx Instance Manager, Nginx Openid Connect

4 products

Nginx Api Connectivity Manager

Nginx Ingress Controller

Nginx Instance Manager

Nginx Openid Connect

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
F5 Nginx Api Connectivity Manager	From 1.3.0 to 1.9.3
F5 Nginx Ingress Controller	Up to 1.12.5
F5 Nginx Ingress Controller	From 2.2.1 to 2.4.2
F5 Nginx Ingress Controller	From 3.0.0 to 3.7.1
F5 Nginx Instance Manager	From 2.5.0 to 2.17.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
F5 Nginx Openid Connect	Before 2024-10-24

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (1)

https://my.f5.com/manage/s/article/K000148232

Source: f5sirt@f5.com

MitigationVendor Advisory

Timeline

No history available yet.