CVE-2024-10318: f5 nginx_api_connectivity_manager Session Fixation

Vulnerability summary

CVE-2024-10318 is a medium (CVSS 5.4) Session Fixation vulnerability in f5 nginx_api_connectivity_manager. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.1% of scored vulnerabilities.

Timeline

1. 06-11-2024
   PublishedVulnerability first disclosed.
2. 06-11-2024
   Last modifiedVulnerability information updated.

Description

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.