Ruby/sinatra/2.0.0

Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.

https://rubygems.org/gems/sinatra
MIT

8 Security Vulnerabilities

Sinatra vulnerable to Reflected File Download attack

Published date: 2022-11-30T21:18:34Z
CVE: CVE-2022-45442
Links:

Description

An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.

References

Affected versions: ["2.1.0", "2.0.8.1", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.1.rc1", "2.0.0", "2.2.0", "2.2.1", "2.2.2", "3.0.0", "3.0.1", "3.0.2", "3.0.3"]
Secure versions: [3.0.4, 2.2.3, 3.0.5, 2.2.4, 3.0.6, 3.1.0, 3.2.0, 4.0.0]
Recommendation: Update to version 4.0.0.

Sinatra Path Traversal vulnerability

Published date: 2018-02-20T19:23:20Z
CVE: CVE-2018-7212
Links:

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.

Affected versions: ["2.0.1.rc1", "2.0.0", "2.0.0.rc6", "2.0.0.rc5", "2.0.0.rc2", "2.0.0.rc1", "2.0.0.beta2", "2.0.0.beta1"]
Secure versions: [3.0.4, 2.2.3, 3.0.5, 2.2.4, 3.0.6, 3.1.0, 3.2.0, 4.0.0]
Recommendation: Update to version 4.0.0.

Sinatra Cross-site Scripting vulnerability

Published date: 2018-06-05T21:32:06Z
CVE: CVE-2018-11627
Links:

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

Affected versions: ["2.0.1", "2.0.1.rc1", "2.0.0"]
Secure versions: [3.0.4, 2.2.3, 3.0.5, 2.2.4, 3.0.6, 3.1.0, 3.2.0, 4.0.0]
Recommendation: Update to version 4.0.0.

sinatra does not validate expanded path matches

Published date: 2022-05-03T00:00:43Z
CVE: CVE-2022-29970
Links:

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

Affected versions: ["2.1.0", "2.0.8.1", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.1.rc1", "2.0.0", "2.0.0.rc6", "2.0.0.rc5", "2.0.0.rc2", "2.0.0.rc1", "2.0.0.beta2", "2.0.0.beta1", "1.4.8", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.4.0.d", "1.4.0.c", "1.4.0.b", "1.4.0.a", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.g", "1.3.0.f", "1.3.0.e", "1.3.0.d", "1.3.0.c", "1.3.0.b", "1.3.0.a", "1.2.9", "1.2.8", "1.2.7", "1.2.6", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.2.0.d", "1.2.0.c", "1.2.0.a", "1.1.4", "1.1.3", "1.1.2", "1.1.0", "1.1.b", "1.1.a", "1.0", "1.0.b", "1.0.a", "0.9.6", "0.9.5", "0.9.4", "0.9.2", "0.9.1.1", "0.9.1", "0.9.0.5", "0.9.0.4", "0.9.0.3", "0.9.0.2", "0.9.0.1", "0.9.0", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.2", "0.2.1", "0.2.0", "0.1.7", "0.1.6", "0.1.5", "0.1.0"]
Secure versions: [3.0.4, 2.2.3, 3.0.5, 2.2.4, 3.0.6, 3.1.0, 3.2.0, 4.0.0]
Recommendation: Update to version 4.0.0.

XSS via the 400 Bad Request page

Published date: 2018-05-31
CVE: 2018-11627
CVSS V3: 6.1
Links:

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

Affected versions: ["2.0.1", "2.0.1.rc1", "2.0.0", "2.0.0.rc6", "2.0.0.rc5", "2.0.0.rc2", "2.0.0.rc1", "2.0.0.beta2", "2.0.0.beta1"]
Secure versions: [3.0.4, 2.2.3, 3.0.5, 2.2.4, 3.0.6, 3.1.0, 3.2.0, 4.0.0]
Recommendation: Update to version 4.0.0.

sinatra ruby gem path traversal via backslash characters on Windows

Published date: 2018-01-09
CVE: 2018-7212
CVSS V2: 5.0
CVSS V3: 5.3
Links:

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.

Affected versions: ["2.0.1.rc1", "2.0.0"]
Secure versions: [3.0.4, 2.2.3, 3.0.5, 2.2.4, 3.0.6, 3.1.0, 3.2.0, 4.0.0]
Recommendation: Update to version 4.0.0.

sinatra does not validate expanded path matches

Published date: 2022-05-03
CVE: 2022-29970
CVSS V2: 5.0
CVSS V3: 7.5
Links:

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

Affected versions: ["2.1.0", "2.0.8.1", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.1.rc1", "2.0.0", "2.0.0.rc6", "2.0.0.rc5", "2.0.0.rc2", "2.0.0.rc1", "2.0.0.beta2", "2.0.0.beta1", "1.4.8", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.4.0.d", "1.4.0.c", "1.4.0.b", "1.4.0.a", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.g", "1.3.0.f", "1.3.0.e", "1.3.0.d", "1.3.0.c", "1.3.0.b", "1.3.0.a", "1.2.9", "1.2.8", "1.2.7", "1.2.6", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.2.0.d", "1.2.0.c", "1.2.0.a", "1.1.4", "1.1.3", "1.1.2", "1.1.0", "1.1.b", "1.1.a", "1.0", "1.0.b", "1.0.a", "0.9.6", "0.9.5", "0.9.4", "0.9.2", "0.9.1.1", "0.9.1", "0.9.0.5", "0.9.0.4", "0.9.0.3", "0.9.0.2", "0.9.0.1", "0.9.0", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.2", "0.2.1", "0.2.0", "0.1.7", "0.1.6", "0.1.5", "0.1.0"]
Secure versions: [3.0.4, 2.2.3, 3.0.5, 2.2.4, 3.0.6, 3.1.0, 3.2.0, 4.0.0]
Recommendation: Update to version 4.0.0.

Sinatra vulnerable to Reflected File Download attack

Published date: 2022-11-30
CVE: 2022-45442
CVSS V3: 8.8
Links:

An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.

Affected versions: ["2.1.0", "2.0.8.1", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.1.rc1", "2.0.0", "2.0.0.rc6", "2.0.0.rc5", "2.0.0.rc2", "2.0.0.rc1", "2.0.0.beta2", "2.0.0.beta1", "1.4.8", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.4.0.d", "1.4.0.c", "1.4.0.b", "1.4.0.a", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.g", "1.3.0.f", "1.3.0.e", "1.3.0.d", "1.3.0.c", "1.3.0.b", "1.3.0.a", "1.2.9", "1.2.8", "1.2.7", "1.2.6", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.2.0.d", "1.2.0.c", "1.2.0.a", "1.1.4", "1.1.3", "1.1.2", "1.1.0", "1.1.b", "1.1.a", "1.0", "1.0.b", "1.0.a", "0.9.6", "0.9.5", "0.9.4", "0.9.2", "0.9.1.1", "0.9.1", "0.9.0.5", "0.9.0.4", "0.9.0.3", "0.9.0.2", "0.9.0.1", "0.9.0", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.2", "0.2.1", "0.2.0", "0.1.7", "0.1.6", "0.1.5", "0.1.0", "3.0.0", "3.0.1", "3.0.2", "3.0.3"]
Secure versions: [3.0.4, 2.2.3, 3.0.5, 2.2.4, 3.0.6, 3.1.0, 3.2.0, 4.0.0]
Recommendation: Update to version 4.0.0.

103 Other Versions

Version License Security Released
0.1.6 UNKNOWN 3 2009-07-25 - 17:52 almost 15 years
0.1.5 UNKNOWN 3 2009-07-25 - 17:52 almost 15 years
0.1.0 UNKNOWN 3 2009-07-25 - 17:52 almost 15 years