CVE-2022-45442

highPriorität · beachten · 45OT-Risiko · hochEPSS 0.007 · 53. PerzentilExploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.69% (53rd) EPSS

CVSS 8.8 · high

Is it mine?

51 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-26

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenpcs-0:0.10.8-1.el8_4.3.aarch64 as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-0:0.10.8-1.el8_4.3.ppc64le as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-0:0.10.8-1.el8_4.3.ppc64le as a component of Red Hat Enterprise Linux ResilientStorage EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-0:0.10.8-1.el8_4.3.s390x as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-0:0.10.8-1.el8_4.3.s390x as a component of Red Hat Enterprise Linux ResilientStorage EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-0:0.10.8-1.el8_4.3.src as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-0:0.10.8-1.el8_4.3.src as a component of Red Hat Enterprise Linux ResilientStorage EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-0:0.10.8-1.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-0:0.10.8-1.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux ResilientStorage EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-snmp-0:0.10.8-1.el8_4.3.aarch64 as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-snmp-0:0.10.8-1.el8_4.3.ppc64le as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-snmp-0:0.10.8-1.el8_4.3.ppc64le as a component of Red Hat Enterprise Linux ResilientStorage EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-snmp-0:0.10.8-1.el8_4.3.s390x as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-snmp-0:0.10.8-1.el8_4.3.s390x as a component of Red Hat Enterprise Linux ResilientStorage EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-snmp-0:0.10.8-1.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux HighAvailability EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506
Behobenpcs-snmp-0:0.10.8-1.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux ResilientStorage EUS (v.8.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:0506

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-494USCWE-494USCWE-494USCWE-494US

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

boost-legal/refilePrivate fork of refile/refile (pinned at c4ac577c) with sinatra ceiling raised to < 4.0 for CVE-2022-45442. See sc-47428.PoC · poc_in_github

betroffene Produkte (51)

Betroffene Produkte und Versionsbereiche.

Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Open Source CentOSalle Versionencert_bundDEcpe:/o:centos:centos:-
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux 8.2alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:8.2
Ubuntu Linuxalle Versionencert_bundDEcpe:/o:canonical:ubuntu_linux:-
sinatra sinatra2.0, → 2.2.3enisa_euvdEU
sinatra sinatra3.0, → 3.0.4enisa_euvdEU
Elastic NV Logstash≤ 7.17.18fstec_bduRU
Novell Inc. SUSE Liberty Linux≤ 8fstec_bduRU
Novell Inc. SUSE Liberty Linux≤ 9fstec_bduRU
Red Hat Inc. Red Hat 3scale API Management Platform≤ 2fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.2 Telecommunications Update Servicefstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.1 Update Services for SAP Solutionsfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.6 Extended Update Supportfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.2 Update Services for SAP Solutionsfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.4 Extended Update Supportfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 9fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 9.0 Extended Update Supportfstec_bduRU

20 von 51 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2023:0506Red Hat Security Advisory: pcs security update2023-01-30csaf · redhat_csafUS
An update for pcs is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2023-0186Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenDeutsch2023-01-23csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-2x8x-jmrp-phxwSinatra vulnerable to Reflected File Download attack2022-11-30ghsa · osvUS
### Description An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. ### References * https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf * https://github.com/advisories/GHSA-8x94-hmjh-97hq

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund redhat_csaf osv NVD CVE.org MITRE

veröffentlicht 2022-11-28geändert 2026-08-04

Referenzen (21)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan