CVE-2023-35887

Summary

CVE-2023-35887 is a vulnerability affecting Apache MINA's SFTP servers. If a RootedFileSystem is used, unauthorized users with logged-in status can gain sensitive information by exploiting the "exists/does not exist" functionality through path traversal and symlink manipulation, potentially accessing data outside the rooted tree. This issue impacts Apache MINA versions prior to 2.10 and necessitates an immediate upgrade to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.