NGINX OIDC Session Fixation Vulnerability
CVE-2024-10318 Published on November 6, 2024
NGINX OpenID Connect Vulnerability
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
Vulnerability Analysis
CVE-2024-10318 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Products Associated with CVE-2024-10318
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-10318 are published in these products:
Affected Versions
F5 NGINX OpenID Connect:- Version fa1ad160e2637d1d583611124478039170d726ab and below 133504f4fd9f72f3e36668f9f2f3d32a86fcb269 is affected.
- Version 2.5.0 and below 2.17.4 is affected.
- Version 1.0.0 and below 1.9.3 is affected.
- Version 1.0.0 and below 3.7.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.