Total vulnerabilities in the database
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
| Software | From | Fixed in |
|---|---|---|
| f5 / nginx_ingress_controller | 3.0.0 | 3.7.1 |
| f5 / nginx_instance_manager | 2.5.0 | 2.17.4 |
| f5 / nginx_api_connectivity_manager | 1.3.0 | 1.9.3 |
| f5 / nginx_ingress_controller | 2.2.1 | 2.4.2.x |
| f5 / nginx_ingress_controller | - | 1.12.5.x |
| f5 / nginx_openid_connect | - | 2024-10-24 |