This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] F5 NGINX OpenID Connect fixes 1 vulnerability

F5 fixes a medium-severity vulnerability in the NGINX OpenID Connect component, which is implemented in several products [1]. Products and their fixes: NGINX Instance Manager - 2.17.4 NGINX API Connectivity Manager - 1.9.3 NGINX Ingress Controller - 3.7.1 NGINX Plus - it is recommended to update the product to version R31 or newer and to further update the nginx-plus-module-njs module and the nginx-openid-connect component. Detailed information can be found at [2].

F5 NGINX OpenID Connect - session misuse (CVE-2024-10318)
CVSS 5.4 (Medium)

An unauthenticated remote attacker is able, using social engineering techniques, to hijack a user's session due to insufficient validation during authentication. NGINX Plus is vulnerable only if the OpenID Connect (NJS-based) component is installed [1][3].

The vulnerability is present in products:

  • NGINX Instance Manager; >=2.5.0, <=2.17.3;
  • NGINX API Connectivity Manager; >=1.3.0, <=1.9.2;
  • NGINX Ingress Controller; ==1.12.5; >=2.2.1, <=2.4.2; >=3.0.0, <=3.7.0;
  • NGINX Plus; <R31;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 6. 11. 2024.

By CESNET, z.s.p.o. Michaela Ručková on 8. 11. 2024.

CESNET, z.s.p.o. Logo