8.8

CVE-2022-45442: debian debian_linux Download of Code Without Integrity Check

CVSS: 8.8v3.1HighModified
AliasesMGASA-2023-0029RHSA-2023:0393RHSA-2023:0427
Published 28-11-2022Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2022-45442 is a high (CVSS 8.8) Download of Code Without Integrity Check vulnerability in debian debian_linux. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.69%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
DLA-3877-1USN-7664-1CVE-2022-36359

Timeline

  1. 28-11-2022
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.69%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

+0.03 pp

From 0.67% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (blackhat.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • ruby-sinatra< 2.0.5-4+deb10u2 | < 3.0.5-2
  • debian_linuxEOL10.0
Redhat2 products
  • pcs< 0:0.10.4-6.el8_2.4 | < 0:0.10.12-6.el8_6.3 | < 0:0.10.8-1.el8_4.3 | < 0:0.11.1-10.el9_0.3 | < 0:0.10.14-5.el8_7.2 | < 0:0.10.2-4.el8_1.3 | < 0:0.11.3-4.el9_1.2
  • pcs-snmp< 0:0.10.4-6.el8_2.4 | < 0:0.10.12-6.el8_6.3 | < 0:0.10.8-1.el8_4.3 | < 0:0.11.1-10.el9_0.3 | < 0:0.10.14-5.el8_7.2 | < 0:0.10.2-4.el8_1.3 | < 0:0.11.3-4.el9_1.2
Mageia1 product
  • ruby-sinatra< 2.0.8.1-1.2.mga8
RubyGems1 product
  • sinatra≥ 3.0, < 3.0.4 | ≥ 2.0.0, < 2.2.3
Sinatra1 product
  • sinatra≥ 3.0, < 3.0.4 | ≥ 2.0, < 2.2.3
Sinatrarb1 product
  • sinatra≥ 2.0.0, < 2.2.3 | ≥ 3.0.0, < 3.0.4
Ubuntu1 product
  • ruby-sinatra< 1.4.7-3ubuntu0.1~esm2 | < 1.4.8-1ubuntu0.1~esm2 | < 2.0.8.1-2+deb11u1build0.22.04.1

7 vendors · 9 products

References

33 links
Show all 33 references