Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcsUpgrade pcs-snmp | May 25, 2022 | May 2, 2022 |
| Centos_linux | — | Upgrade rubygem-unicodeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-little-pluggerUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-mime-typesUpgrade satellite-cloneUpgrade pcsUpgrade satellite-maintainUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode-display_widthUpgrade rubygem-jwtUpgrade rubygem-mime-types-dataUpgrade rubygem-netrcUpgrade rubygem-unfUpgrade pcs-snmpUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-gssapiUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-unf_extUpgrade rubygem-foreman_maintainUpgrade rubygem-fast_gettextUpgrade foreman-cliUpgrade rubygem-http-cookieUpgrade rubygem-rest-clientUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffiUpgrade rubygem-highlineUpgrade rubygem-hashie | May 20, 2022 | May 2, 2022 |
| Debian | — | Upgrade ruby-sinatra | Oct 31, 2022 | May 2, 2022 |
| Oracle_linux | — | Upgrade pcsUpgrade pcs-snmp | May 20, 2022 | May 2, 2022 |
| Redhat_linux | — | Upgrade pcsNo solution existsUpgrade pcs-snmp | May 17, 2022 | May 2, 2022 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade pcs-snmpUpgrade libdb-debuginfoUpgrade pcsUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfo | Jul 11, 2022 | May 2, 2022 |
| Ubuntu | — | Upgrade ruby-sinatra (Ubuntu Pro)Upgrade ruby-sinatra | Jun 26, 2025 | May 2, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub