Wiz
Vulnerability DatabaseCVE-2024-10318

CVE-2024-10318: 
NGINX Ingress Controller (NGINX Inc) vulnerability analysis and mitigation

Overview

A session fixation vulnerability (CVE-2024-10318) was discovered in the NGINX OpenID Connect reference implementation. The vulnerability was disclosed on November 6, 2024, and affects multiple NGINX products including NGINX API Connectivity Manager, NGINX Ingress Controller, NGINX Instance Manager, and NGINX OpenID Connect reference implementation (NVD).

Technical details

The vulnerability stems from a failure to check the nonce parameter at login time in the NGINX OpenID Connect reference implementation. The severity of this vulnerability has been assessed with a CVSS v4.0 base score of 5.1 (Medium) and CVSS v3.1 base score of 5.4 (Medium). The vulnerability is classified as CWE-384 (Session Fixation) (NVD).

Impact

When exploited, this vulnerability allows an attacker to fix a victim's session to an attacker-controlled account. While the attacker cannot directly log in as the victim, they can force the session to associate with their controlled account, potentially leading to misuse of the victim's session (NVD).

Mitigation and workarounds

F5 Networks has released security updates to address this vulnerability. The fix is available in versions after NGINX OpenID Connect 2024-10-24, NGINX API Connectivity Manager 1.9.3, NGINX Ingress Controller 3.7.1, and NGINX Instance Manager 2.17.4 (NVD).

Additional resources

Source: This report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues

Cloud threat landscape

Cloud threat landscape

A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques

PEACH

PEACH

A step-by-step framework for modeling and improving SaaS and PaaS tenant isolation

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo