CVE-2024-10318

🗓️ 06 Nov 2024 16:48:56Reported by f5Type

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 619 Views

Session fixation flaw in NGINX OpenID Connect allows attacker to control victim's sessio

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the authentication module through the OpenID Connect protocol in NGINX web servers, related to improper session management, allows attackers to gain full access to the application.	14 Nov 202400:00	–	bdu_fstec
CNNVD	F5 Nginx 授权问题漏洞	6 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-10318 NGINX OpenID Connect Vulnerability	6 Nov 202416:48	–	cvelist
EUVD	EUVD-2024-33036	3 Oct 202520:07	–	euvd
F5 Networks	K000148232: NGINX OpenID Connect vulnerability CVE-2024-10318	6 Nov 202414:56	–	f5
F5 Networks	K12201527: Overview of Quarterly Security Notifications	20 Dec 202219:14	–	f5
NVD	CVE-2024-10318	6 Nov 202417:15	–	nvd
Positive Technologies	PT-2024-7993 · F5 +1 · F5 Networks +1	6 Nov 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-10318	6 Nov 202419:00	–	redhatcve
Vulnrichment	CVE-2024-10318 NGINX OpenID Connect Vulnerability	6 Nov 202416:48	–	vulnrichment

NVD

Node

f5 nginx_api_connectivity_managerRange1.3.0–1.9.3

f5 nginx_ingress_controllerRange≤1.12.5

f5 nginx_ingress_controllerRange2.2.1–2.4.2

f5 nginx_ingress_controllerRange3.0.0–3.7.1

f5 nginx_instance_managerRange2.5.0–2.17.4

Node

f5 nginx_openid_connectRange<2024-10-24nginx_plus

[
  {
    "defaultStatus": "unknown",
    "product": "NGINX OpenID Connect",
    "repo": "https://github.com/nginxinc/nginx-openid-connect/",
    "vendor": "F5",
    "versions": [
      {
        "lessThan": "133504f4fd9f72f3e36668f9f2f3d32a86fcb269",
        "status": "affected",
        "version": "fa1ad160e2637d1d583611124478039170d726ab",
        "versionType": "git"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NGINX Instance Manager",
    "vendor": "F5",
    "versions": [
      {
        "lessThan": "2.17.4",
        "status": "affected",
        "version": "2.5.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NGINX API Connectivity Manager",
    "vendor": "F5",
    "versions": [
      {
        "lessThan": "1.9.3",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NGINX Ingress Controller",
    "vendor": "F5",
    "versions": [
      {
        "lessThan": "3.7.1",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
my	www.my.f5.com/manage/s/article/K000148232

17 Jun 2026 06:55Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.4

CVSS 45.1

EPSS0.00339

SSVC

CWE-384