Apache MINA SSHD: Information disclosure bugs with RootedFilesystem
CVE-2023-35887

5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Mina Sshd
Vendor
CVE Published:
10 July 2023

What is CVE-2023-35887?

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.

In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.

This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

Affected Version(s)

Apache MINA SSHD 1.0 < 2.10

References

https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21...
vendor-advisory

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Pikler
.
CVE-2023-35887 : Apache MINA SSHD: Information disclosure bugs with RootedFilesystem