Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcs | May 25, 2022 | May 2, 2022 |
| Centos_linux | — | Upgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_extUpgrade rubygem-ffi-debugsourceUpgrade satellite-cliUpgrade rubygem-foreman_maintainUpgrade rubygem-loggingUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade rubygem-fast_gettextUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-http-cookieUpgrade rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-domain_nameUpgrade rubygem-highlineUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hashieUpgrade pcs-snmpUpgrade rubygem-localeUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-mime-types-dataUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicodeUpgrade rubygem-jwtUpgrade rubygem-multi_jsonUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_templatesUpgrade pcsUpgrade rubygem-oauthUpgrade satellite-cloneUpgrade rubygem-unicode-display_widthUpgrade rubygem-netrcUpgrade rubygem-unfUpgrade rubygem-unicode-debugsource | May 20, 2022 | May 2, 2022 |
| Debian | — | Upgrade ruby-sinatra | Oct 31, 2022 | May 2, 2022 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade pcs | May 20, 2022 | May 2, 2022 |
| Redhat_linux | — | Upgrade pcsNo solution existsUpgrade pcs-snmp | May 17, 2022 | May 2, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade pcsUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade pcs-snmp | Jul 11, 2022 | May 2, 2022 |
| Ubuntu | — | Upgrade ruby-sinatraUpgrade ruby-sinatra (Ubuntu Pro) | Jun 26, 2025 | May 2, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub