CVE-2009-2422: Critical severity ruby on rails vulnerability
The example code for the digest authentication functionality (httpauthentication.rb) in Ruby on Rails before 2.3.3 defines an authenticateorrequestwithhttpdigest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2422?
The severity of CVE-2009-2422 is considered to be moderate as it allows attackers to bypass authentication under certain conditions.
How do I fix CVE-2009-2422?
To fix CVE-2009-2422, you should upgrade to Ruby on Rails version 2.3.3 or later.
What does CVE-2009-2422 affect?
CVE-2009-2422 affects Ruby on Rails versions before 2.3.3, particularly its digest authentication functionality.
When was CVE-2009-2422 published?
CVE-2009-2422 was published on July 28, 2009.
Who is impacted by CVE-2009-2422?
Context-dependent attackers can exploit CVE-2009-2422 to bypass authentication in applications using affected versions of Ruby on Rails.