Skip to content
Fencer Vulns
high 8.8

CVE-2022-45442 json

Sinatra vulnerable to Reflected File Download attack

published 2022-11-28 3 y ago modified 2026-06-17 4 mo ago also GHSA-2x8x-jmrp-phxw , EUVD-2022-7200

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Patch / fix

  • rubygems sinatra 2.2.3, 3.0.4
  • sinatrarb sinatra 2.2.3, 3.0.4
  • ruby-sinatra Debian 14, Debian 13, Debian 12 3.0.5-2

debian advisories DEBIAN-CVE-2022-45442

  • ruby-sinatra Ubuntu 22.04 LTS 2.0.8.1-2+deb11u1build0.22.04.1
  • ruby-sinatra Ubuntu Pro 16.04 LTS 1.4.7-3ubuntu0.1~esm2
  • ruby-sinatra Ubuntu Pro 18.04 LTS 1.4.8-1ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2022-45442

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • pcs RHEL 9 0.11.3-4.el9_1.2
  • pcs-snmp RHEL 9 0.11.3-4.el9_1.2
  • pcs RHEL 8 0.10.14-5.el8_7.2
  • pcs-snmp RHEL 8 0.10.14-5.el8_7.2
  • pcs RHEL 8.1 E4S 0.10.2-4.el8_1.3
  • pcs-snmp RHEL 8.1 E4S 0.10.2-4.el8_1.3
  • pcs RHEL 8.6 EUS 0.10.12-6.el8_6.3
  • pcs-snmp RHEL 8.6 EUS 0.10.12-6.el8_6.3

red hat advisories RHSA-2023:0974RHSA-2023:0857RHSA-2023:0855RHSA-2023:0427RHSA-2023:0506RHSA-2023:0527

  • pcs AlmaLinux 9 0.11.3-4.el9_1.2
  • pcs-snmp AlmaLinux 9 0.11.3-4.el9_1.2
  • pcs AlmaLinux 8 0.10.14-5.el8_7.2.alma
  • pcs-snmp AlmaLinux 8 0.10.14-5.el8_7.2.alma

almalinux advisories ALSA-2023:0974ALSA-2023:0855

  • pcs Rocky Linux 8 0.10.14-5.el8_7.2

rocky linux advisories RLSA-2023:0855

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-45442 updated cvss 8.8

sinatra: Reflected File Download attack

  • Red Hat 3scale API Management Platform 2 3scale-amp2/zync-rhel8, 3scale-amp2/backend-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux High Availability (v. 8) pcs 0.10.14-5.el8_7.2, pcs-snmp 0.10.14-5.el8_7.2
    fixed: vendor fix RHSA-2023:0855
  • Red Hat Enterprise Linux High Availability (v. 9) pcs 0.11.3-4.el9_1.2, pcs-snmp 0.11.3-4.el9_1.2
    fixed: vendor fix RHSA-2023:0974
  • Red Hat Enterprise Linux High Availability E4S (v. 8.1) pcs 0.10.2-4.el8_1.3, pcs-snmp 0.10.2-4.el8_1.3
    fixed: vendor fix RHSA-2023:0857
  • Red Hat Enterprise Linux High Availability E4S (v. 8.2) pcs 0.10.4-6.el8_2.4, pcs-snmp 0.10.4-6.el8_2.4
    fixed: vendor fix RHSA-2023:0393
  • Red Hat Enterprise Linux High Availability EUS (v.8.6) pcs 0.10.12-6.el8_6.3, pcs-snmp 0.10.12-6.el8_6.3
    fixed: vendor fix RHSA-2023:0427
  • Red Hat Enterprise Linux High Availability EUS (v.9.0) pcs 0.11.1-10.el9_0.3, pcs-snmp 0.11.1-10.el9_0.3
    fixed: vendor fix RHSA-2023:0527
  • Red Hat Enterprise Linux High Availability TUS (v. 8.2) pcs 0.10.4-6.el8_2.4, pcs-snmp 0.10.4-6.el8_2.4
    fixed: vendor fix RHSA-2023:0393
show 6 more
  • Red Hat Enterprise Linux HighAvailability EUS (v.8.4) pcs 0.10.8-1.el8_4.3, pcs-snmp 0.10.8-1.el8_4.3
    fixed: vendor fix RHSA-2023:0506
  • Red Hat Enterprise Linux Resilient Storage (v. 8) pcs 0.10.14-5.el8_7.2, pcs-snmp 0.10.14-5.el8_7.2
    fixed: vendor fix RHSA-2023:0855
  • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs 0.11.3-4.el9_1.2, pcs-snmp 0.11.3-4.el9_1.2
    fixed: vendor fix RHSA-2023:0974
  • Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) pcs 0.10.12-6.el8_6.3, pcs-snmp 0.10.12-6.el8_6.3
    fixed: vendor fix RHSA-2023:0427
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) pcs 0.11.1-10.el9_0.3, pcs-snmp 0.11.1-10.el9_0.3
    fixed: vendor fix RHSA-2023:0527
  • Red Hat Enterprise Linux ResilientStorage EUS (v.8.4) pcs 0.10.8-1.el8_4.3, pcs-snmp 0.10.8-1.el8_4.3
    fixed: vendor fix RHSA-2023:0506

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • blackhat.com https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems sinatra
>=3.0, <3.0.4
>=2.0.0, <2.2.3
3.0.4
2.2.3

Affected products

  • sinatra sinatra

Classification

Weakness
  • CWE-494 Download of Code Without Integrity Check

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.