CVE-2009-2422

Опубликовано: 10 июл. 2009

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.

Ссылки

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
Mailing List
http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s
Exploit
Patch
http://secunia.com/advisories/35702
Broken Link
Vendor Advisory
http://support.apple.com/kb/HT4077
Third Party Advisory
http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest
Patch
http://www.securityfocus.com/bid/35579
Broken Link
Patch
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2009/1802
Broken Link
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51528
Third Party Advisory
VDB Entry
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
Mailing List
http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s
Exploit
Patch
http://secunia.com/advisories/35702
Broken Link
Vendor Advisory
http://support.apple.com/kb/HT4077
Third Party Advisory
http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest
Patch
http://www.securityfocus.com/bid/35579
Broken Link
Patch
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2009/1802
Broken Link
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51528
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*

Версия до 2.3.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Версия от 10.6.0 (включая) до 10.6.3 (исключая)

cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*

Версия от 10.6.0 (включая) до 10.6.3 (исключая)

cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00403

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

CVE-2009-2422

CVSS3: 9.8

ubuntu

больше 16 лет назад

CVE-2009-2422

CVSS3: 9.8

debian

больше 16 лет назад

The example code for the digest authentication functionality (http_aut ...

GHSA-rxq3-gm4p-5fj4

CVSS3: 9.8

github

больше 8 лет назад

rails vulnerable to improper authentication

EPSS

Процентиль: 60%

0.00403

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287