Session fixation in F5 Networks products - CVE-2024-10318
Published: November 7, 2024
Vulnerability identifier: #VU100049
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-10318
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to compromise accounts of other users.
The vulnerability exists due to a session fixation issue within the NGINX OpenID Connect reference implementation. A remote user can associate a victim's session with an account controlled by the attacker and gain unauthorized access to the application.
Affected software
NGINX API Connectivity Manager
NGINX Ingress Controller
NGINX Instance Manager
NGINX Ingress Controller
NGINX Instance Manager
How to mitigate CVE-2024-10318
Install updates from vendor's website.
NGINX API Connectivity Manager - update to 1.9.3
NGINX Ingress Controller - update to 3.7.1
NGINX Instance Manager - update to 2.17.4
NGINX Ingress Controller - update to 3.7.1
NGINX Instance Manager - update to 2.17.4