CVE-2022-45442
Sinatra vulnerable to Reflected File Download attack
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
Sinatra es un lenguaje de dominio específico para crear aplicaciones web en Ruby. Se descubrió un problema en Sinatra 2.0 anterior a 2.2.3 y 3.0 anterior a 3.0.4. Una aplicación es vulnerable a un ataque de Reflected File Download (RFD) que establece el encabezado Content-Disposition de una respuesta cuando el nombre del archivo se deriva de una entrada proporcionada por el usuario. Las versiones 2.2.3 y 3.0.4 contienen parches para este problema.
A flaw was found in Sinatra, a domain-specific language for creating web applications in Ruby. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-11-15 CVE Reserved
- 2022-11-28 CVE Published
- 2024-07-19 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-494: Download of Code Without Integrity Check
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://github.com/advisories/GHSA-8x94-hmjh-97hq | Not Applicable | |
| https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf | 2024-08-03 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b | 2023-02-01 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-45442 | 2023-02-28 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2153363 | 2023-02-28 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sinatrarb Search vendor "Sinatrarb" | Sinatra Search vendor "Sinatrarb" for product "Sinatra" | >= 2.0.0 < 2.2.3 Search vendor "Sinatrarb" for product "Sinatra" and version " >= 2.0.0 < 2.2.3" | - |
Affected
| ||||||
| Sinatrarb Search vendor "Sinatrarb" | Sinatra Search vendor "Sinatrarb" for product "Sinatra" | >= 3.0.0 < 3.0.4 Search vendor "Sinatrarb" for product "Sinatra" and version " >= 3.0.0 < 3.0.4" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||