CVE-2025-23419

Katalog CVE

CVSS 4.3 · Medium EPSS 2,8%

Kerentanan Incorrect Authorization pada f5 nginx, f5 nginx plus +1 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut f5.com.

Deskripsi (NVD)

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Rincian

Terbit di NVD

5 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber f5.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

2,8% peluang dieksploitasi; lebih tinggi dari 86,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://my.f5.com/manage/s/article/K000149173 advisory vendor
• http://www.openwall.com/lists/oss-security/2025/02/05/8 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html issue tracking · advisory pihak ketiga