CVE-2023-35887CWE-22

Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

Medium · published July 10, 2023

CVSS v3.1
5.0
EPSS
1%
Percentile
70.4
In the wild
Unconfirmed
What it is

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.

In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.

This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01311 · 70.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-07-10T09:28Z
EPSS history
Timeline
  • 10 JUL 09:28Z
    Apache MINA SSHD: Information disclosure bugs with RootedFilesystem
    cvelistv5