WID-SEC-2024-3364 — NGINX OpenID Connect: Schwachstelle ermöglicht Erlangen von Benutzerrechten

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in der NGINX OpenID Connect Referenzimplementierung ausnutzen, um Benutzerrechte zu erlangen.

Product

NGINX ist eine Webserver-, Reverse Proxy- und E-Mail-Proxy Software.

Vulnerabilities 1

Medium 5.4

CVE-2024-10318

NGINX OpenID Connect Vulnerability

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the atta…

F5 NGINX Ingress Controller NGINX Instance Manager NGINX API Connectivity Manager Network devices

Nov 6, 2024

Revision history

2024-11-06 #1
Initiale Fassung

References

F5 NGINX Security Advisory vom 2024-11-06
https://my.f5.com/manage/s/article/K000148232
NIST Vulnerability Database vom 2024-11-06
https://nvd.nist.gov/vuln/detail/CVE-2024-10318