CVE-2024-10318: A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce wa
32
Routine
MEDIUM 5.4WATCHLISTUPGRADEUPGRADEUPGRADE
CVE-2024-10318 is a medium-severity flaw (CVSS 5.4) affecting nginx api connectivity manager, nginx ingress controller, nginx instance manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-10318?
nginx api connectivity manager: upgrade to 1.9.3; nginx ingress controller: upgrade to 3.7.1; nginx instance manager: upgrade to 2.17.4. Exact commands for each OS are on this page.
Is CVE-2024-10318 being exploited?
CVE-2024-10318 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-10318 affect?
CVE-2024-10318 affects nginx api connectivity manager, nginx ingress controller, nginx instance manager. Severity is medium (CVSS 5.4). A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result
PatchTheCVE