CVE-2009-2422

Published: 10 July 2009

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.

Priority

Cvss 3 Severity Score

9.8

Score breakdown

Status

Package	Release	Status
rails Launchpad, Ubuntu, Debian	dapper	Not vulnerable (code not present)
	hardy	Not vulnerable (code not present)
	intrepid	Not vulnerable (code not present)
	jaunty	Not vulnerable (code not present)
	upstream	Released (2.3.3)

Severity score breakdown

Parameter	Value
Base score	9.8
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›