CVE-2023-35887
MediumCVSS 5.0Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
CVE-2023-35887 vulnerability in Apache MINA exposes sensitive information to unauthorized actors. Logged users on SFTP servers may discover 'exists/does not exist' information about items outside the rooted tree using parent navigation or symlinks.
Risk Assessment
Organizations may be at risk of sensitive data exposure, potentially leading to further attacks or privacy breaches. Specifically, unauthorized users could gain access to information that should be protected.
Recommendation
It is recommended to upgrade to Apache MINA version 2.10 or later to mitigate this vulnerability. Additionally, review the SFTP server configuration to restrict access to sensitive data.
Original NVD description (English source)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10