CVE-2022-45442

Name of the Vulnerable Software and Affected Versions Sinatra versions 2.0 through 2.2.2 Sinatra versions 3.0 through 3.0.3

Description The issue is related to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. This allows an attacker to execute arbitrary code. The vulnerability is associated with the loading of code without checking its integrity.

Recommendations For Sinatra versions 2.0 through 2.2.2, update to version 2.2.3 to resolve the issue. For Sinatra versions 3.0 through 3.0.3, update to version 3.0.4 to resolve the issue. As a temporary workaround, consider restricting the use of user-supplied input in the filename to minimize the risk of exploitation.