Every CVE Search/ Get API key

CVE-2022-45442

Sinatra vulnerable to Reflected File Download attack

8.8 HighPublic exploitFix available

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.69%Down 0.3 points since Nov 29, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.8

Sinatra vulnerable to Reflected File Download attack

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Record
CVE-2022-45442
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-494
Updated
2026-11-02
EUVDEUVD-2022-7200 8.8

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Record
EUVD-2022-7200
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2x8x-jmrp-phxw 8.8

Sinatra vulnerable to Reflected File Download attack

Description

An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.

References

Record
GHSA-2x8x-jmrp-phxw
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-494
Updated
2026-11-02
NVD 8.8

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Record
CVE-2022-45442
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-494
Updated
2026-11-02
OSV 8.8

Sinatra vulnerable to Reflected File Download attack

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Record
CVE-2022-45442
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-494
Updated
2026-11-02
OSVGHSA-2x8x-jmrp-phxw 8.8

Sinatra vulnerable to Reflected File Download attack

Description

An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.

References

Record
GHSA-2x8x-jmrp-phxw
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-494
Updated
2026-11-02
Show 21 moreShow less
OSVOESA-2024-2474 8.8

rubygem-sinatra security update

Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.

Security Fix(es):

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)

Record
OESA-2024-2474
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2475 8.8

rubygem-sinatra security update

Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.

Security Fix(es):

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)

Record
OESA-2024-2475
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2476 8.8

rubygem-sinatra security update

Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.

Security Fix(es):

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)

Record
OESA-2024-2476
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2477 8.8

rubygem-sinatra security update

Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.

Security Fix(es):

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)

Record
OESA-2024-2477
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2490 8.8

rubygem-sinatra security update

Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.

Security Fix(es):

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)

Record
OESA-2024-2490
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0393 8.8

Red Hat Security Advisory: pcs security update

Record
RHSA-2023:0393
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0427 8.8

Red Hat Security Advisory: pcs security update

Record
RHSA-2023:0427
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0506 8.8

Red Hat Security Advisory: pcs security update

Record
RHSA-2023:0506
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0527 8.8

Red Hat Security Advisory: pcs security update

Record
RHSA-2023:0527
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0855 8.8

Red Hat Security Advisory: pcs security update

Record
RHSA-2023:0855
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0857 8.8

Red Hat Security Advisory: pcs security update

Record
RHSA-2023:0857
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0974 8.8

Red Hat Security Advisory: pcs security update

Record
RHSA-2023:0974
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2023:0855 8.8

Moderate: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • sinatra: Reflected File Download attack (CVE-2022-45442)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:0855
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-45442 8.8

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Record
UBUNTU-CVE-2022-45442
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2023:0855 No score

Moderate: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • sinatra: Reflected File Download attack (CVE-2022-45442)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:0855
Updated
2026-11-02
OSVALSA-2023:0974 No score

Moderate: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • sinatra: Reflected File Download attack (CVE-2022-45442)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:0974
Updated
2026-11-02
OSVCLSA-2026-1790610952 No score

pcs: Fix of 7 CVEs

  • CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
  • CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
  • CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
  • CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
  • CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
  • CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
  • CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado
Record
CLSA-2026-1790610952
Updated
2026-11-02
OSVCLSA-2026-1790611274 No score

pcs: Fix of 7 CVEs

  • CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
  • CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
  • CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
  • CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
  • CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
  • CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
  • CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado
Record
CLSA-2026-1790611274
Updated
2026-11-02
OSVDEBIAN-CVE-2022-45442 No score

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Record
DEBIAN-CVE-2022-45442
Updated
2026-11-03
OSVMGASA-2023-0029 No score

Updated ruby-sinatra packages fix security vulnerability

Potential reflected file download (RFD) vulnerability in ruby-sinatra, a Ruby library for writing HTTP applications. A Content-Disposition HTTP header was being incorrectly derived from a potentially user-supplied filename. (CVE-2022-45442)

Record
MGASA-2023-0029
Updated
2026-11-02
OSVUSN-7664-1 No score

ruby-sinatra vulnerabilities

It was discovered that Sinatra incorrectly handled serving static files. An attacker could possibly use this issue to perform local file inclusion, obtaining sensitive information. (CVE-2022-29970)

It was discovered that Sinatra incorrectly handled special characters in the Content-Disposition HTTP header. An attacker could possibly use this issue to perform a reflected file download attack, achieving remote code execution. (CVE-2022-45442)

Record
USN-7664-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sinatra
RubyGems
 3.0 up to 3.0.4
3.0.4
sinatra
RubyGems
 2.0.0 up to 2.2.3
2.2.3
pcs
AlmaLinux:8
 before 0.10.14-5.el8_7.2.alma
0.10.14-5.el8_7.2.alma
pcs-snmp
AlmaLinux:8
 before 0.10.14-5.el8_7.2.alma
0.10.14-5.el8_7.2.alma
pcs
AlmaLinux:9
 before 0.11.3-4.el9_1.2
0.11.3-4.el9_1.2
pcs-snmp
AlmaLinux:9
 before 0.11.3-4.el9_1.2
0.11.3-4.el9_1.2
pcs
TuxCare:CentOS:8.4
From an advisory covering 7 CVEs
 before 0.10.8-1.el8.tuxcare.els2
0.10.8-1.el8.tuxcare.els2
pcs-snmp
TuxCare:CentOS:8.4
From an advisory covering 7 CVEs
 before 0.10.8-1.el8.tuxcare.els2
0.10.8-1.el8.tuxcare.els2
pcs
TuxCare:CentOS:8.5
From an advisory covering 7 CVEs
 before 0.10.8-1.el8.tuxcare.els2
0.10.8-1.el8.tuxcare.els2
pcs-snmp
TuxCare:CentOS:8.5
From an advisory covering 7 CVEs
 before 0.10.8-1.el8.tuxcare.els2
0.10.8-1.el8.tuxcare.els2
Show 47 moreShow less
Affected packages
PackageAffectedFixed
ruby-sinatra
Debian:12
 before 3.0.5-2
3.0.5-2
ruby-sinatra
Debian:13
 before 3.0.5-2
3.0.5-2
ruby-sinatra
Debian:14
 before 3.0.5-2
3.0.5-2
ruby-sinatra
Debian:10
 before 2.0.5-4+deb10u2, plus listed versions
2.0.5-42.0.5-4+deb10u1
2.0.5-4+deb10u2
ruby-sinatra
Debian:11
From an advisory covering 2 CVEs
 before 2.0.8.1-2+deb11u1, plus listed versions
2.0.8.1-2
2.0.8.1-2+deb11u1
sinatra
RubyGems
 3.0 up to 3.0.4, plus listed versions
3.0.03.0.13.0.23.0.3
3.0.4
sinatra
RubyGems
 2.0.0 up to 2.2.3, plus listed versions
2.0.12.0.1.rc12.0.22.0.32.0.4
Show 9 moreShow less
2.0.52.0.62.0.72.0.82.0.8.12.1.02.2.02.2.12.2.2
2.2.3
ruby-sinatra
Mageia:8
 before 2.0.8.1-1.2.mga8
2.0.8.1-1.2.mga8
rubygem-sinatra
openEuler:22.03-LTS-SP1
 before 2.0.8.1-3.oe2203sp1
2.0.8.1-3.oe2203sp1
rubygem-sinatra
openEuler:24.03-LTS
 before 2.0.8.1-4.oe2403
2.0.8.1-4.oe2403
rubygem-sinatra
openEuler:22.03-LTS-SP4
 before 2.0.8.1-3.oe2203sp4
2.0.8.1-3.oe2203sp4
rubygem-sinatra
openEuler:22.03-LTS-SP3
 before 2.0.8.1-3.oe2203sp3
2.0.8.1-3.oe2203sp3
rubygem-sinatra
openEuler:20.03-LTS-SP4
 before 2.0.3-3.oe2003sp4
2.0.3-3.oe2003sp4
pcs
Red Hat:rhel_e4s:8.2::highavailability
 before 0:0.10.4-6.el8_2.4
0:0.10.4-6.el8_2.4
pcs-snmp
Red Hat:rhel_e4s:8.2::highavailability
 before 0:0.10.4-6.el8_2.4
0:0.10.4-6.el8_2.4
pcs
Red Hat:rhel_tus:8.2::highavailability
 before 0:0.10.4-6.el8_2.4
0:0.10.4-6.el8_2.4
pcs-snmp
Red Hat:rhel_tus:8.2::highavailability
 before 0:0.10.4-6.el8_2.4
0:0.10.4-6.el8_2.4
pcs
Red Hat:rhel_eus:8.6::highavailability
 before 0:0.10.12-6.el8_6.3
0:0.10.12-6.el8_6.3
pcs-snmp
Red Hat:rhel_eus:8.6::highavailability
 before 0:0.10.12-6.el8_6.3
0:0.10.12-6.el8_6.3
pcs
Red Hat:rhel_eus:8.6::resilientstorage
 before 0:0.10.12-6.el8_6.3
0:0.10.12-6.el8_6.3
pcs-snmp
Red Hat:rhel_eus:8.6::resilientstorage
 before 0:0.10.12-6.el8_6.3
0:0.10.12-6.el8_6.3
pcs
Red Hat:rhel_eus:8.4::highavailability
 before 0:0.10.8-1.el8_4.3
0:0.10.8-1.el8_4.3
pcs-snmp
Red Hat:rhel_eus:8.4::highavailability
 before 0:0.10.8-1.el8_4.3
0:0.10.8-1.el8_4.3
pcs
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:0.10.8-1.el8_4.3
0:0.10.8-1.el8_4.3
pcs-snmp
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:0.10.8-1.el8_4.3
0:0.10.8-1.el8_4.3
pcs
Red Hat:rhel_eus:9.0::highavailability
 before 0:0.11.1-10.el9_0.3
0:0.11.1-10.el9_0.3
pcs-snmp
Red Hat:rhel_eus:9.0::highavailability
 before 0:0.11.1-10.el9_0.3
0:0.11.1-10.el9_0.3
pcs
Red Hat:rhel_eus:9.0::resilientstorage
 before 0:0.11.1-10.el9_0.3
0:0.11.1-10.el9_0.3
pcs-snmp
Red Hat:rhel_eus:9.0::resilientstorage
 before 0:0.11.1-10.el9_0.3
0:0.11.1-10.el9_0.3
pcs
Red Hat:enterprise_linux:8::highavailability
 before 0:0.10.14-5.el8_7.2
0:0.10.14-5.el8_7.2
pcs-snmp
Red Hat:enterprise_linux:8::highavailability
 before 0:0.10.14-5.el8_7.2
0:0.10.14-5.el8_7.2
pcs
Red Hat:enterprise_linux:8::resilientstorage
 before 0:0.10.14-5.el8_7.2
0:0.10.14-5.el8_7.2
pcs-snmp
Red Hat:enterprise_linux:8::resilientstorage
 before 0:0.10.14-5.el8_7.2
0:0.10.14-5.el8_7.2
pcs
Red Hat:rhel_e4s:8.1::highavailability
 before 0:0.10.2-4.el8_1.3
0:0.10.2-4.el8_1.3
pcs-snmp
Red Hat:rhel_e4s:8.1::highavailability
 before 0:0.10.2-4.el8_1.3
0:0.10.2-4.el8_1.3
pcs
Red Hat:enterprise_linux:9::highavailability
 before 0:0.11.3-4.el9_1.2
0:0.11.3-4.el9_1.2
pcs-snmp
Red Hat:enterprise_linux:9::highavailability
 before 0:0.11.3-4.el9_1.2
0:0.11.3-4.el9_1.2
pcs
Red Hat:enterprise_linux:9::resilientstorage
 before 0:0.11.3-4.el9_1.2
0:0.11.3-4.el9_1.2
pcs-snmp
Red Hat:enterprise_linux:9::resilientstorage
 before 0:0.11.3-4.el9_1.2
0:0.11.3-4.el9_1.2
pcs
Rocky Linux:8
 before 0:0.10.14-5.el8_7.2
0:0.10.14-5.el8_7.2
ruby-sinatra
Ubuntu:Pro:16.04:LTS
 before 1.4.7-3ubuntu0.1~esm2, plus listed versions
1.4.6-21.4.7-3
1.4.7-3ubuntu0.1~esm2
ruby-sinatra
Ubuntu:Pro:18.04:LTS
 before 1.4.8-1ubuntu0.1~esm2, plus listed versions
1.4.7-51.4.8-1
1.4.8-1ubuntu0.1~esm2
ruby-sinatra
Ubuntu:22.04:LTS
 before 2.0.8.1-2+deb11u1build0.22.04.1, plus listed versions
2.0.8.1-2
2.0.8.1-2+deb11u1build0.22.04.1
ruby-sinatra
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 1.4.7-3ubuntu0.1~esm2, plus listed versions
1.4.6-21.4.7-3
1.4.7-3ubuntu0.1~esm2
ruby-sinatra
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 1.4.8-1ubuntu0.1~esm2, plus listed versions
1.4.7-51.4.8-1
1.4.8-1ubuntu0.1~esm2
ruby-sinatra
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 2.0.8.1-1ubuntu0.1~esm2, plus listed versions
2.0.5-4ubuntu12.0.8.1-1
2.0.8.1-1ubuntu0.1~esm2
ruby-sinatra
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 2.0.8.1-2+deb11u1build0.22.04.1, plus listed versions
2.0.8.1-2
2.0.8.1-2+deb11u1build0.22.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubboost-legal/refile2026-06-30

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45442 is a high vulnerability (CVSS 8.8) in Sinatra, published November 28, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in sinatra 3.0.4.

References

Show 47 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open