CVE-2022-45442

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

• CWE-494

• https://github.com/advisories/GHSA-8x94-hmjh-97hqNot Applicable
• https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363bPatch, Third Party Advisory
• https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxwThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00005.htmlMailing List, Third Party Advisory
• https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdfExploit, Third Party Advisory
• https://github.com/advisories/GHSA-8x94-hmjh-97hqNot Applicable
• https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363bPatch, Third Party Advisory
• https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxwThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00005.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html
• https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdfExploit, Third Party Advisory

Published

Nov 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45437Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2022-45438When explicitly enabling the feature flag DASHBOARD_CACHE (d…5.3
• CVE-2022-45439A pair of spare WiFi credentials is stored in the configurat…6.5
• CVE-2022-4544The MashShare WordPress plugin before 3.8.7 does not validat…5.4
• CVE-2022-45440A vulnerability exists in the FTP server of the Zyxel AX7501…4.4
• CVE-2022-45441A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N…6.1
• CVE-2022-45444Sewio’s Real-Time Location System (RTLS) Studio version 2.0.…9.8
• CVE-2022-45447M4 PDF plugin for Prestashop sites, in its 3.2.3 version and…6.5
• CVE-2022-45448M4 PDF plugin for Prestashop sites, in its 3.2.3 version and…6.1
• CVE-2022-45449Sensitive information disclosure due to excessive privileges…6.5
• CVE-2022-4545The Sitemap WordPress plugin before 4.4 does not validate an…5.4
• CVE-2022-45450Sensitive information disclosure and manipulation due to imp…7.5