CVE-2009-2422

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.

• CWE-287

• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlMailing List
• http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3sExploit, Patch
• http://secunia.com/advisories/35702Broken Link, Vendor Advisory
• http://support.apple.com/kb/HT4077Third Party Advisory
• http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digestPatch
• http://www.securityfocus.com/bid/35579Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/1802Broken Link, Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51528Third Party Advisory, VDB Entry
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlMailing List
• http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3sExploit, Patch
• http://secunia.com/advisories/35702Broken Link, Vendor Advisory
• http://support.apple.com/kb/HT4077Third Party Advisory
• http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digestPatch
• http://www.securityfocus.com/bid/35579Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/1802Broken Link, Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51528Third Party Advisory, VDB Entry

Published

Jul 10, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2416Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2…6.5
• CVE-2009-2417lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when Op…
• CVE-2009-2418Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2009-2419Use-after-free vulnerability in the servePendingRequests fun…
• CVE-2009-2420Apple Safari 3.2.3 does not properly implement the file: pro…
• CVE-2009-2421The CFCharacterSetInitInlineBuffer method in CoreFoundation.…
• CVE-2009-2423SQL injection vulnerability in category.php in Ebay Clone 20…
• CVE-2009-2424Cross-site scripting (XSS) vulnerability in search.php in Eb…
• CVE-2009-2425Tor before 0.2.0.35 allows remote attackers to cause a denia…
• CVE-2009-2426The connection_edge_process_relay_cell_not_open function in …
• CVE-2009-2427SQL injection vulnerability in co-profile.php in Jobbr 2.2.7…
• CVE-2009-2428Multiple SQL injection vulnerabilities in Tausch Ticket Scri…