You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
mend-for-github-combot
changed the title
sinatra-2.1.0.gem: 1 vulnerabilities (highest severity is: 7.5)
sinatra-2.1.0.gem: 2 vulnerabilities (highest severity is: 8.8)
Nov 30, 2022
mend-for-github-combot
changed the title
sinatra-2.1.0.gem: 2 vulnerabilities (highest severity is: 8.8)
sinatra-2.1.0.gem: 3 vulnerabilities (highest severity is: 8.8)
Nov 4, 2024
Vulnerable Library - sinatra-2.1.0.gem
Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.
Library home page: https://rubygems.org/gems/sinatra-2.1.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/sinatra-2.1.0.gem
Found in HEAD commit: cd22e7bbb091fa1c59c8c70354777107c4f253bf
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-45442
Vulnerable Library - sinatra-2.1.0.gem
Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.
Library home page: https://rubygems.org/gems/sinatra-2.1.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/sinatra-2.1.0.gem
Dependency Hierarchy:
Found in HEAD commit: cd22e7bbb091fa1c59c8c70354777107c4f253bf
Found in base branch: master
Vulnerability Details
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
Publish Date: 2022-11-28
URL: CVE-2022-45442
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.5%
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-2x8x-jmrp-phxw
Release Date: 2022-11-28
Fix Resolution: sinatra - 2.2.3,3.0.4
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2022-29970
Vulnerable Library - sinatra-2.1.0.gem
Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.
Library home page: https://rubygems.org/gems/sinatra-2.1.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/sinatra-2.1.0.gem
Dependency Hierarchy:
Found in HEAD commit: cd22e7bbb091fa1c59c8c70354777107c4f253bf
Found in base branch: master
Vulnerability Details
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Publish Date: 2022-05-02
URL: CVE-2022-29970
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.2%
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-qp49-3pvw-x4m5
Release Date: 2022-05-02
Fix Resolution: sinatra - 2.2.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2024-21510
Vulnerable Library - sinatra-2.1.0.gem
Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.
Library home page: https://rubygems.org/gems/sinatra-2.1.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/sinatra-2.1.0.gem
Dependency Hierarchy:
Found in HEAD commit: cd22e7bbb091fa1c59c8c70354777107c4f253bf
Found in base branch: master
Vulnerability Details
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Publish Date: 2024-11-01
URL: CVE-2024-21510
Threat Assessment
Exploit Maturity: Proof of concept
EPSS: 0.0%
CVSS 3 Score Details (5.4)
Base Score Metrics:
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: