swagger-api / swagger-api/swagger-codegen

Description

CVE-2022-29970 - High Severity Vulnerability

Vulnerable Library - sinatra-1.4.6.gem

Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.

Library home page: https://rubygems.org/gems/sinatra-1.4.6.gem

Dependency Hierarchy:

• ❌ sinatra-1.4.6.gem (Vulnerable Library)

Found in HEAD commit: 4b7a8d7d7384aa6a27d6309c35ade0916edae7ed

Found in base branch: master

Vulnerability Details

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

Publish Date: 2022-05-02

URL: CVE-2022-29970

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-qp49-3pvw-x4m5

Release Date: 2022-05-02

Fix Resolution: sinatra - 2.2.0

Contributor guide

Open the contributing guide

First steps

1. Read the whole issue, then the project's contributing guide.
2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
3. Fork the repository and make your change on a branch.
4. Open a pull request that references the issue number.

Research direction

Assessment

Tech stack

ruby

Domain

backend, security

Issue type

Bug

Difficulty

3/5

Estimated time

1-2 days

Activity status

Stale

Clarity

Mostly clear

Newbie friendliness

35/100