Lucene search
Veracode Vulnerability DatabaseVERACODE:38288HistoryNov 29, 2022 - 5:26 a.m.
Reflected File Download
2022-11-2905:26:03
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
16
sinatra
vulnerability
file download
validation
missing validations
base.rb
untrusted file downloads
EPSS
0.005
Percentile
77.7%
sinatra is vulnerable to reflected file download. The vulnerability exists because of missing validations of attachment function in base.rb which allows an attacker to perform untrusted file downloads.
References
github.com/advisories/GHSA-8x94-hmjh-97hq
github.com/sinatra/sinatra/commit/1808bcdf3424eab0c659ef2d0e85579aab977a1a
github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b
github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw
lists.debian.org/debian-lts-announce/2023/01/msg00005.html
www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf
Related
nessus
nessus
RHEL 8 : pcs (RHSA-2023:0393)
2023-01-24 00:00:00
RHEL 8 : pcs (RHSA-2023:0857)
2023-02-21 00:00:00
AlmaLinux 9 : pcs (ALSA-2023:0974)
2023-02-28 00:00:00
ubuntucve
ubuntucve
CVE-2022-45442
2022-11-28 00:00:00
debian
debian
[SECURITY] [DLA 3264-1] ruby-sinatra security update
2023-01-10 19:00:22
oraclelinux
oraclelinux
pcs security update
2023-03-01 00:00:00
pcs security update
2023-02-22 00:00:00
osv
osv
Moderate: pcs security update
2023-02-28 00:00:00
ruby-sinatra - security update
2023-01-10 00:00:00
Moderate: pcs security update
2023-02-22 01:08:55
redhat
redhat
(RHSA-2023:0974) Moderate: pcs security update
2023-02-28 07:53:55
(RHSA-2023:0857) Moderate: pcs security update
2023-02-21 09:57:03
(RHSA-2023:0427) Moderate: pcs security update
2023-01-24 14:00:57
mageia
mageia
Updated ruby-sinatra packages fix security vulnerability
2023-02-07 03:06:39
nvd
nvd
CVE-2022-45442
2022-11-28 21:15:10
almalinux
almalinux
Moderate: pcs security update
2023-02-28 00:00:00
Moderate: pcs security update
2023-02-21 00:00:00
cve
cve
CVE-2022-45442
2022-11-28 21:15:10
prion
prion
Input validation
2022-11-28 21:15:00
debiancve
debiancve
CVE-2022-45442
2022-11-28 21:15:10
redhatcve
redhatcve
CVE-2022-45442
2022-12-14 13:36:10
rubygems
rubygems
Sinatra vulnerable to Reflected File Download attack
2022-11-29 21:00:00
rocky
rocky
pcs security update
2023-02-22 01:08:55
redos
redos
ROS-20240524-03
2024-05-24 00:00:00
cvelist
cvelist
CVE-2022-45442 Sinatra vulnerable to Reflected File Download attack
2022-11-28 00:00:00
openvas
openvas
Mageia: Security Advisory (MGASA-2023-0029)
2023-03-28 00:00:00
Debian: Security Advisory (DLA-3264-1)
2023-01-11 00:00:00
Debian: Security Advisory (DLA-3877-1)
2024-09-06 00:00:00
github
github
Sinatra vulnerable to Reflected File Download attack
2022-11-30 21:18:34