{"id":"CVE-2022-45442","published":"2022-11-28T00:00:00Z","modified":"2025-11-04T16:09:56Z","title":"Sinatra vulnerable to Reflected File Download attack","vendor":"sinatra","product":"sinatra","tier":"tail","description":{"text":"Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00691,"percentile":0.52745,"provenance":"source"},"cwes":[{"id":"CWE-494","name":"Download of Code Without Integrity Check"}],"references":[{"url":"https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw","tags":[]},{"url":"https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b","tags":[]},{"url":"https://github.com/advisories/GHSA-8x94-hmjh-97hq","tags":[]},{"url":"https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html","tags":[]}],"priority":{"score":21.7,"factors":[{"name":"EPSS percentile","points":10.55},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.16}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-06-30","earliestUrl":"https://github.com/boost-legal/refile","repos":[{"name":"boost-legal/refile","url":"https://github.com/boost-legal/refile","stars":0,"created":"2026-06-30"}]},"first":{"date":"2026-06-30","source":"PoC-in-GitHub","url":"https://github.com/boost-legal/refile"},"provenance":"source"},"vendorSlug":"sinatra","affectedVersions":[{"vendor":"sinatra","product":"sinatra","versions":[">= 3.0, < 3.0.4",">= 2.0, < 2.2.3"]}],"affected":[{"ecosystem":"RubyGems","package":"sinatra","vulnerableRanges":[">=3.0, <3.0.4",">=2.0.0, <2.2.3"],"patched":["3.0.4","2.2.3"],"from":["GHSA-2x8x-jmrp-phxw"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7200","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sinatra-cve-2018-11627","parents":[{"from":"CVE-2022-29970","to":"CVE-2022-45442","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:sinatra","fromFixed":"2.2.0","toFixed":"2.2.3","daysApart":210},{"kind":"same-code","provenance":"machine","files":["lib/sinatra/base.rb"],"commits":["https://github.com/sinatra/sinatra/commit/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e","https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b"],"basis":"rarely changed file"}]},{"from":"CVE-2022-36359","to":"CVE-2022-45442","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-8x94-hmjh-97hq","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-2x8x-jmrp-phxw","via":"reference","url":"https://github.com/advisories/GHSA-8x94-hmjh-97hq"}]}],"packageHistory":[{"cve":"CVE-2018-7212","published":"2018-02-18","fixed":"2.0.1","kev":false},{"cve":"CVE-2018-11627","published":"2018-05-31","fixed":"2.0.2","kev":false},{"cve":"CVE-2022-29970","published":"2022-05-02","fixed":"2.2.0","kev":false},{"cve":"CVE-2022-45442","published":"2022-11-28","fixed":"3.0.4","kev":false},{"cve":"CVE-2024-21510","published":"2024-11-01","fixed":"4.1.0","kev":false},{"cve":"CVE-2025-61921","published":"2025-10-10","fixed":"4.2.0","kev":false}],"package":"RubyGems:sinatra"}}