PT-2024-7993 · Nginx+1 · Nginx Openid Connect+1
Published
2024-11-06
·
Updated
2024-11-18
·
CVE-2024-10318
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
NGINX OpenID Connect (affected versions not specified)
F5 Networks (affected versions not specified)
Description
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account, leading to potential misuse of the victim's session. The attacker can force the session to associate it with the attacker-controlled account, although they cannot log in as the victim.
Recommendations
As a temporary workaround, consider disabling the OpenID Connect module until a patch is available.
Restrict access to the vulnerable OpenID Connect implementation to minimize the risk of exploitation.
Avoid using the affected NGINX OpenID Connect reference implementation until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Verification of Cryptographic Signature
Session Fixation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
F5 Networks
Nginx Openid Connect