CVE-2022-45442 — Download of Code Without Integrity Check in Sinatra

CWE-494 — Download of Code Without Integrity Check9 documents7 sources

Severity

8.8HIGHNVD

OSV7.5

EPSS

0.3%

top 45.17%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Sinatrarb Sinatra Sinatra Debian Linux

Timeline

PublishedNov 28

Latest updateJul 22

Description

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶RubyGemssinatra/sinatra3.0 — 3.0.4+1

▶NVDsinatrarb/sinatra2.0.0 — 2.2.3+1

▶CVEListV5sinatra/sinatra>= 2.0, < 2.2.3, >= 3.0, < 3.0.4+1

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

ruby-sinatra vulnerabilities↗2025-07-22

▶

GHSA

Sinatra vulnerable to Reflected File Download attack↗2022-11-30

▶

OSV

Sinatra vulnerable to Reflected File Download attack↗2022-11-30

▶

OSV

CVE-2022-45442: Sinatra is a domain-specific language for creating web applications in Ruby↗2022-11-28

▶

CVEList

Sinatra vulnerable to Reflected File Download attack↗2022-11-28

▶

📋Vendor Advisories

Ubuntu

Sinatra vulnerabilities↗2025-07-22

▶

Red Hat

sinatra: Reflected File Download attack↗2022-11-28

▶

Debian

CVE-2022-45442: ruby-sinatra - Sinatra is a domain-specific language for creating web applications in Ruby. An ...↗2022

▶