8.8

CVE-2022-45442

Exploit

Sinatra vulnerable to Reflected File Download attack

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sinatrarb ≫ Sinatra Version >= 2.0.0 < 2.2.3
Sinatrarb ≫ Sinatra Version >= 3.0.0 < 3.0.4
Debian ≫ Debian Linux Version10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.64% 0.459
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
security-advisories@github.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-494 Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

https://github.com/advisories/GHSA-8x94-hmjh-97hq
Not Applicable
https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b
Patch
Third Party Advisory
https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html
Third Party Advisory
Mailing List
https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf
Third Party Advisory
Exploit
https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html