CVE-2022-45442

Katalog CVE

CVSS 8.8 · High EPSS 0,69%

Kerentanan Download of Code Without Integrity Check pada sinatrarb sinatra, debian linux. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Rincian

Terbit di NVD

28 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-494: Download of Code Without Integrity Check

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b patch · advisory pihak ketiga
• https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html mailing list · advisory pihak ketiga
• https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf exploit · advisory pihak ketiga
• https://github.com/advisories/GHSA-8x94-hmjh-97hq not applicable
• https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html