medium5.4
CVE-2024-10318
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time.
Impact
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| F5 | Nginx Api Connectivity Manager | from 1.3.0 before 1.9.3 |
| F5 | Nginx Ingress Controller | through 1.12.5 from 2.2.1 through 2.4.2 from 3.0.0 before 3.7.1 |
| F5 | Nginx Instance Manager | from 2.5.0 before 2.17.4 |
| F5 | Nginx Openid Connect | before 2024-10-24 |