sinatra-3.0.2.gem: 2 vulnerabilities (highest severity is: 8.8)

[mend-for-github-com]

Vulnerable Library - sinatra-3.0.2.gem

Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.

Library home page: https://rubygems.org/gems/sinatra-3.0.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /.7.0/cache/sinatra-3.0.2.gem

Vulnerabilities

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (sinatra version)	Remediation Possible**	Reachability
CVE-2022-45442	High	8.8	Not Defined	0.5%	sinatra-3.0.2.gem	Direct	sinatra - 2.2.3,3.0.4	✅
CVE-2024-21510	Medium	5.4	Proof of concept	0.0%	sinatra-3.0.2.gem	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-45442

Vulnerable Library - sinatra-3.0.2.gem

Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.

Library home page: https://rubygems.org/gems/sinatra-3.0.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /.7.0/cache/sinatra-3.0.2.gem

Dependency Hierarchy:

• ❌ sinatra-3.0.2.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Publish Date: 2022-11-28

URL: CVE-2022-45442

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.5%

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2x8x-jmrp-phxw

Release Date: 2022-11-28

Fix Resolution: sinatra - 2.2.3,3.0.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-21510

Vulnerable Library - sinatra-3.0.2.gem

Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.

Library home page: https://rubygems.org/gems/sinatra-3.0.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /.7.0/cache/sinatra-3.0.2.gem

Dependency Hierarchy:

• ❌ sinatra-3.0.2.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Publish Date: 2024-11-01

URL: CVE-2024-21510

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 0.0%

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

---

⛑️Automatic Remediation will be attempted for this issue.