CVE-2022-45442

HIGH
Published Nov 28, 20223y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Nov 28, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-494

Affected Products 3

VendorProductVersionRange
sinatrarbsinatra*≥2.0.0  –  <2.2.3
sinatrarbsinatra*≥3.0.0  –  <3.0.4
debiandebian_linux10.0any

References 6

  • github.com https://github.com/advisories/GHSA-8x94-hmjh-97hq
    Not Applicable
  • github.com https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b
    PatchThird Party Advisory
  • github.com https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw
    Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html
  • blackhat.com https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b
    PatchThird Party Advisory