Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcsUpgrade pcs-snmp | May 25, 2022 | May 2, 2022 |
| Centos_linux | — | Upgrade rubygem-ffi-debugsourceUpgrade rubygem-hashieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-fast_gettextUpgrade rubygem-rest-clientUpgrade satellite-cliUpgrade rubygem-localeUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-http-cookieUpgrade python39-pulp_manifestUpgrade rubygem-amazing_printUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade pcs-snmpUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-gssapiUpgrade rubygem-hammer_cliUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-domain_nameUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffiUpgrade rubygem-mime-typesUpgrade rubygem-mime-types-dataUpgrade rubygem-jwtUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicodeUpgrade satellite-cloneUpgrade rubygem-unfUpgrade rubygem-oauthUpgrade rubygem-little-pluggerUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_templatesUpgrade pcsUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-unicode-display_width | May 20, 2022 | May 2, 2022 |
| Debian | — | Upgrade ruby-sinatra | Oct 31, 2022 | May 2, 2022 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade pcs | May 20, 2022 | May 2, 2022 |
| Redhat_linux | — | Upgrade pcsNo solution existsUpgrade pcs-snmp | May 17, 2022 | May 2, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade pcsUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade pcs-snmpUpgrade libdb-debugsource | Jul 11, 2022 | May 2, 2022 |
| Ubuntu | — | Upgrade ruby-sinatraUpgrade ruby-sinatra (Ubuntu Pro) | Jun 26, 2025 | May 2, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub