CVE-2009-2422
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
El código de ejemplo para la funcionalidad de autenticación digest (http_authentication.rb) en Ruby on Rails anterior a v2.3.3 define un bloque authenticate_or_request_with_http_digest que devolverá nulo en lugar de falso cuando el usuario no existe, lo cual permite a atacantes dependiendo del contexto eludir la autenticación para aplicaciones que se derivan de este ejemplo mediante el envío de un nombre de usuario no válido sin una contraseña.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-07-10 CVE Reserved
- 2009-07-10 CVE Published
- 2024-02-14 EPSS Updated
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-287: Improper Authentication
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://support.apple.com/kb/HT4077 | Third Party Advisory |
|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/51528 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s | 2024-08-07 |
| URL | Date | SRC |
|---|---|---|
| http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest | 2024-02-13 | |
| http://www.securityfocus.com/bid/35579 | 2024-02-13 | |
| http://www.vupen.com/english/advisories/2009/1802 | 2024-02-13 |
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html | 2024-02-13 | |
| http://secunia.com/advisories/35702 | 2024-02-13 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | < 2.3.3 Search vendor "Rubyonrails" for product "Ruby On Rails" and version " < 2.3.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | >= 10.6.0 < 10.6.3 Search vendor "Apple" for product "Mac Os X" and version " >= 10.6.0 < 10.6.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.5.8 Search vendor "Apple" for product "Mac Os X" and version "10.5.8" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Server Search vendor "Apple" for product "Mac Os X Server" | >= 10.6.0 < 10.6.3 Search vendor "Apple" for product "Mac Os X Server" and version " >= 10.6.0 < 10.6.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Server Search vendor "Apple" for product "Mac Os X Server" | 10.5.8 Search vendor "Apple" for product "Mac Os X Server" and version "10.5.8" | - |
Affected
| ||||||