Sinatrarb Sinatra 2.0.6

CPE Details

Sinatrarb Sinatra 2.0.6
sinatrarb
sinatra
2.0.6
2022-05-09
09h51 +00:00
2022-05-20
16h56 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:sinatrarb:sinatra:2.0.6:*:*:*:*:*:*:*

Informations

Vendor

sinatrarb

Product

sinatra

Version

2.0.6

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-45442 2022-11-27 23h00 +00:00 Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
8.8
High
CVE-2022-29970 2022-05-01 22h00 +00:00 Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
7.5
High