CVE-2023-35887

16

FAUCET Score

CVE-2023-35887 is a sensitive information exposure vulnerability affecting Apache MINA SSHD versions prior to 2.10. Logged-in users of SFTP servers using a RootedFileSystem can determine the existence of files and directories outside their allowed root via path manipulation or symlinks. This medium-severity vulnerability (CVSS 4.3) has a low impact on confidentiality, requiring low privileges and network access, but no user interaction. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.0.0, < 2.9.3CPE matchmatch criteria	cpe:2.3:a:apache:sshd::::::::

CVSS Data

CVSS version used by this source: 3.1

5.0MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

3.1

Impact Score

1.4

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.31%

Probability of exploitation in next 30 days

EPSS Percentile

67.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0131 is in the 81st percentile among its peer group of 21,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (28)

mavenpatch availablevia ghsa

Product: org.apache.sshd:sshd-commonFixed in: 2.9.3

mavenpatch availablevia ghsa

Product: org.apache.sshd:sshd-coreFixed in: 2.1.0

mavenpatch availablevia ghsa

Product: org.apache.sshd:sshd-sftpFixed in: 2.9.3

redhatpatch availablevia redhat_api

Product: Red Hat Data Grid 8.4.4Fixed in: apache-mina

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: sshd-common

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-undertow-0:2.2.28-1.SP1_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-wildfly-0:7.4.14-5.GA_redhat_00002.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-undertow-0:2.2.28-1.SP1_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wildfly-0:7.4.14-5.GA_redhat_00002.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-undertow-0:2.2.28-1.SP1_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-wildfly-0:7.4.14-5.GA_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-apache-sshd-0:2.12.0-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-log4j-0:2.19.0-2.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-lucene-solr-0:8.11.2-2.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-parsson-0:1.1.5-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-wildfly-0:8.0.1-3.GA_redhat_00002.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-apache-sshd-0:2.12.0-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-eclipse-jgit-0:6.6.1.202309021850-1.r_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-log4j-0:2.19.0-2.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-lucene-solr-0:8.11.2-2.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-parsson-0:1.1.5-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-wildfly-0:8.0.1-3.GA_redhat_00002.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-eclipse-jgit-0:6.6.1.202309021850-1.r_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: EAP 8.0.1Fixed in: sshd-common

redhatpatch availablevia redhat_api

Product: Red Hat build of Quarkus 2.13.9.FinalFixed in: org.apache.sshd/sshd-common:2.10.0.redhat-00002

redhatno patchvia redhat_api

Product: Red Hat Integration Camel Quarkus 2Fixed in: sshd-common

redhatend of lifevia redhat_api

Product: OpenShift ServerlessFixed in: sshd-common

redhatend of lifevia redhat_api

Product: Red Hat Single Sign-On 7Fixed in: sshd-common

Vendor Advisories (2)

mavenGHSA-mjmq-gwgm-5qhmmedium

Apache MINA SSHD information disclosure vulnerability

redhatCVE-2023-35887Moderate

apache-mina-sshd: information exposure in SFTP server implementations

References

lists.apache.org / thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2

Mailing ListVendor Advisory