Sinatra vulnerable to Reflected File Download attack
Published: November 30, 2022
SECURITY IDENTIFIERS
- CVE: CVE-2022-45442 (NVD)
- GHSA: GHSA-2x8x-jmrp-phxw
- Vendor Advisory: https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw
GEM
SEVERITY
CVSS v3.x: 8.8 (High)
PATCHED VERSIONS
~> 2.2.3
>= 3.0.4
DESCRIPTION
An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.