{"schema_version":"1.9.0","id":"GHSA-mjmq-gwgm-5qhm","published":"2023-07-10T18:30:49Z","modified":"2026-09-10T03:50:02.653103986Z","aliases":["CVE-2023-35887"],"summary":"Apache MINA SSHD information disclosure vulnerability","details":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.\n\nIn SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover \"exists/does not exist\" information about items outside the rooted tree via paths including parent navigation (\"..\") beyond the root, or involving symlinks.\n\nThis issue affects Apache MINA: from 1.0 before 2.9.3 Users are recommended to upgrade to 2.9.3\n\nUntil version 2.1.0, some of the code affected by this vulnerability appeared in org.apache.sshd:sshd-core. Version 2.1.0 contains a [commit](https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0) where the code was moved to the package org.apache.sshd:sshd-common, which did not exist until version 2.1.0.\n","affected":[{"package":{"name":"org.apache.sshd:sshd-common","ecosystem":"Maven","purl":"pkg:maven/org.apache.sshd/sshd-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.9.3"}]}],"versions":["2.1.0","2.2.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1","2.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-mjmq-gwgm-5qhm/GHSA-mjmq-gwgm-5qhm.json"}},{"package":{"name":"org.apache.sshd:sshd-sftp","ecosystem":"Maven","purl":"pkg:maven/org.apache.sshd/sshd-sftp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.9.3"}]}],"versions":["2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1","2.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-mjmq-gwgm-5qhm/GHSA-mjmq-gwgm-5qhm.json"}},{"package":{"name":"org.apache.sshd:sshd-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.sshd/sshd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.1.0"}]}],"versions":["1.0.0","1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.6.0","1.7.0","2.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-mjmq-gwgm-5qhm/GHSA-mjmq-gwgm-5qhm.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35887"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/pull/362"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/commit/a61e93035f06bff8fc622ad94870fb773d48b9f0"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/commit/c20739b43aab0f7bf2ccad982a6cb37b9d5a8a0b"},{"type":"PACKAGE","url":"https://github.com/apache/mina-sshd"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/SSHD-1324"},{"type":"WEB","url":"https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2"}],"database_specific":{"cwe_ids":["CWE-200","CWE-22"],"github_reviewed":true,"github_reviewed_at":"2023-07-10T21:53:01Z","nvd_published_at":"2023-07-10T16:15:53Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}]}