CVE-2009-2422

CRITICAL 9.8

En bref

Source: NVD
EPSS: EPSS 3.38 % · centile 89 (2026-10-31)
État: PUBLISHED
Publiée: 2009-07-10 15:00 UTC
Mise à jour: 2024-08-07 05:52 UTC
Attribuée par: mitre
Statut NVD: Modified

Rechercher sur…

Description

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.

Faiblesses (CWE)

CWE-287 — Authentification incorrecte

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Avis

GHSA-rxq3-gm4p-5fj4 — rails vulnerable to improper authentication

Références européennes

ENISA EUVD · EUVD-2017-0307
GCVE · GCVE-0-2009-2422

Avis du CERT-FR

CERTA-2010-AVI-143 — Multiples vulnérabilités dans Apple MacOS X · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:* < 2.3.3
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* ≥ 10.6.0 < 10.6.3
cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:* ≥ 10.6.0 < 10.6.3
cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
	affected n/a

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 CVE-2009-2422