PT-2022-7277 · Sinatra+8 · Sinatra+8
Motoyasu-Saburi
·
Published
2022-08-03
·
Updated
2025-07-22
·
CVE-2022-45442
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Sinatra versions 2.0 through 2.2.2
Sinatra versions 3.0 through 3.0.3
Description
The issue is related to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. This allows an attacker to execute arbitrary code. The vulnerability is associated with the loading of code without checking its integrity.
Recommendations
For Sinatra versions 2.0 through 2.2.2, update to version 2.2.3 to resolve the issue.
For Sinatra versions 3.0 through 3.0.3, update to version 3.0.4 to resolve the issue.
As a temporary workaround, consider restricting the use of user-supplied input in the filename to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Sinatra
Ubuntu