CVE-2023-35887
Apache MINA SSHD: Information disclosure bugs with RootedFilesystem
MEDIUM 4.3EPSS 1.3%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10
- Affected
- Apache Software Foundation · Apache MINA SSHD
- CVSS v3.1 NVD
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS v3.1 APACHE
- 5.0 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - EPSS
- 1.31% chance of exploitation in the next 30 days, 70th percentile
- Published
- 2023-07-10
- Updated
- 2024-10-07
Proof-of-concept exploits (1)
- shoucheng3/apache__mina-sshd_CVE-2023-35887_2-9-20★ · 2025-08-18