- Description
- When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Source
- f5sirt@f5.com
- NVD status
- Received
CVSS 4.0
- Type
- Secondary
- Base score
- 5.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- MEDIUM
CVSS 3.1
- Type
- Secondary
- Base score
- 4.3
- Impact score
- 1.4
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
- f5sirt@f5.com
- CWE-287
- Hype score
- Not currently trending
Nginx, Des attaquants peuvent contourner les mécanismes de Sécurité et accéder aux zones sensibles du serveur. Faille critique référencée CVE-2025-23419 de score CVSS évalué à 9.8/10. https://t.co/5SPirwUDpU #.Contournement de Politique Sécurité #.Correctif #.Faille #CERT
@NicolasCoolman
12 Feb 2025
9 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
Top 5 Trending CVEs: 1 - CVE-2024-12754 2 - CVE-2025-23369 3 - CVE-2024-46982 4 - CVE-2025-23419 5 - CVE-2025-20124 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W
@CVEShield
10 Feb 2025
18 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Top 5 Trending CVEs: 1 - CVE-2025-23369 2 - CVE-2025-23419 3 - CVE-2025-21298 4 - CVE-2024-21413 5 - CVE-2013-2678 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W
@CVEShield
9 Feb 2025
11 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Cloudflare quickly resolved a vulnerability in its Mutual TLS (mTLS) implementation (CVE-2025-23419) that allowed session resumption without validating certificates. Security enhanced! 🔒✨ #Cloudflare #mTLS #USA link: https://t.co/LecdCYlD3Q https://t.co/8xp5rp5Clv
@TweetThreatNews
8 Feb 2025
54 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
nginxの脆弱性(Moderate: CVE-2025-23419) https://t.co/0DkxdrtiBn
@matsuu_zatsu
8 Feb 2025
113 Impressions
0 Retweets
3 Likes
0 Bookmarks
0 Replies
0 Quotes
In 2017, @Cloudflare announced it was retiring the "Server: cloudflare-nginx" HTTP header as its infrastructure evolved beyond NGINX: https://t.co/VwyWhocUem Now, in 2025, Cloudflare was affected by an NGINX bug (CVE-2025-23419): https://t.co/6ZDxuVVfOs
@CTF
7 Feb 2025
17 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Cloudflare patched a Mutual TLS (mTLS) vulnerability (CVE-2025-23419) reported via our Bug Bounty Program. The issue was mitigated in 32 hours by disabling session resumption for mTLS connections. Here we have details on the background and remediation of the issue.… https://t.co/
@Cloudflare
7 Feb 2025
10505 Impressions
13 Retweets
88 Likes
15 Bookmarks
1 Reply
3 Quotes
F5 warns of a critical TLS session resumption vulnerability (CVE-2025-23419) in NGINX, allowing unauthorized access by bypassing client certificate authentication. Affects versions R28-R33 & 1.11.4-1.27.31. ⚠️ #NGINX #CyberAlert #USA link: https://t.co/XQaUbDqehM https://t.c
@TweetThreatNews
7 Feb 2025
19 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[#KUSANAGI9 Updated!] KUSANAGI 9 Module Update KUSANAGI 9 modules have been updated. The updated modules are as follows: nginx126 1.26.3-1 This update includes support for vulnerability(CVE-2025-23419). The module... https://t.co/2SoJk7JVXd #KUSANAGI #KUSANAGI9
@kusanagi_saya
7 Feb 2025
30 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-23419 impacts Nginx Server #NginxServer #CVE-2025-23419 https://t.co/jiqZQvqNHl
@pravin_karthik
7 Feb 2025
29 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-23419: nginx: Client certificate authentication bypass with TLSv1.3 and session resumption https://t.co/dmG8Fhj5df
@oss_security
5 Feb 2025
59 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes