sinatra does not validate expanded path matches

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-29970 · ADVISORY
• sinatra/sinatra#1683 · WEB
• sinatra/sinatra#1683 · WEB
• skylightio/skylight-ruby#294 · WEB
• rubysec/ruby-advisory-db · WEB
• sinatra/sinatra · WEB
• lists.debian.org/debian-lts-announce/2022/10/msg00034.html · WEB
• lists.debian.org/debian-lts-announce/2024/09/msg00020.html · WEB

sinatra のその他の脆弱性

• CVE-2025-61921高 7.5Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulner…
• CVE-2024-21510中 5.4Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (X…
• CVE-2022-45442高 8.8Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 bef…
• CVE-2018-11627中 6.1Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
• CVE-2018-7212中 5.3An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is p…