Test ID:	1.3.6.1.4.1.25623.1.0.800912
Category:	Web application abuses
Title:	Ruby on Rails Authentication Bypass Vulnerability
Summary:	Ruby on Rails, is prone to an authentication bypass vulnerability.
Description:	Summary: Ruby on Rails, is prone to an authentication bypass vulnerability. Vulnerability Insight: This Flaw is caused During login process, the digest authentication functionality (http_authentication.rb) returns a 'nil' instead of 'false' when the provided username is not found and then proceeds to verify this value against the provided password. Vulnerability Impact: Successful exploitation will allow attacker to bypass authentication by providing an invalid username with an empty password and gain unauthorized access to the system. Affected Software/OS: Ruby on Rails version 2.3.2 and prior. Solution: Update to version 2.3.3 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-2422 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html BugTraq ID: 35579 http://www.securityfocus.com/bid/35579 http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s http://secunia.com/advisories/35702 http://www.vupen.com/english/advisories/2009/1802 XForce ISS Database: rubyonrails-validatedigest-sec-bypass(51528) https://exchange.xforce.ibmcloud.com/vulnerabilities/51528
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.