Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-kqua-31gy-6qdx

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.

In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.

This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

Aliases

alias	CVE-2023-35887

alias	GHSA-mjmq-gwgm-5qhm

Fixed_packages

url	pkg:maven/org.apache.sshd/sshd@2.9.3
purl	pkg:maven/org.apache.sshd/sshd@2.9.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.sshd/sshd@2.9.3

url	pkg:maven/org.apache.sshd/sshd-common@2.10.0
purl	pkg:maven/org.apache.sshd/sshd-common@2.10.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.sshd/sshd-common@2.10.0

url	pkg:maven/org.apache.sshd/sshd-core@2.10.0
purl	pkg:maven/org.apache.sshd/sshd-core@2.10.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.sshd/sshd-core@2.10.0

url	pkg:maven/org.apache.sshd/sshd-sftp@2.10.0
purl	pkg:maven/org.apache.sshd/sshd-sftp@2.10.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.sshd/sshd-sftp@2.10.0

Affected_packages

url pkg:maven/org.apache.directory.mina/mina@1.0.0

purl pkg:maven/org.apache.directory.mina/mina@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-kqua-31gy-6qdx

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.directory.mina/mina@1.0.0

url pkg:maven/org.apache.sshd/sshd@1.0.0

purl pkg:maven/org.apache.sshd/sshd@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-kqua-31gy-6qdx

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.sshd/sshd@1.0.0

url pkg:maven/org.apache.sshd/sshd-common@1.0.0

purl pkg:maven/org.apache.sshd/sshd-common@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-kqua-31gy-6qdx

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.sshd/sshd-common@1.0.0

url pkg:maven/org.apache.sshd/sshd-core@1.0.0

purl pkg:maven/org.apache.sshd/sshd-core@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-kqua-31gy-6qdx

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.sshd/sshd-core@1.0.0

url pkg:maven/org.apache.sshd/sshd-sftp@1.0.0

purl pkg:maven/org.apache.sshd/sshd-sftp@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-kqua-31gy-6qdx

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.sshd/sshd-sftp@1.0.0

References

reference_url	https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0
reference_id
reference_type
scores
url	https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0

reference_url	https://github.com/apache/mina-sshd/commit/a61e93035f06bff8fc622ad94870fb773d48b9f0
reference_id
reference_type
scores
url	https://github.com/apache/mina-sshd/commit/a61e93035f06bff8fc622ad94870fb773d48b9f0

reference_url	https://github.com/apache/mina-sshd/pull/362
reference_id
reference_type
scores
url	https://github.com/apache/mina-sshd/pull/362

reference_url	https://issues.apache.org/jira/browse/SSHD-1324
reference_id
reference_type
scores
url	https://issues.apache.org/jira/browse/SSHD-1324

reference_url	https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2
reference_id
reference_type
scores
url	https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-35887
reference_id	CVE-2023-35887
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-35887

reference_url	https://github.com/advisories/GHSA-mjmq-gwgm-5qhm
reference_id	GHSA-mjmq-gwgm-5qhm
reference_type
scores
url	https://github.com/advisories/GHSA-mjmq-gwgm-5qhm

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	22
name	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kqua-31gy-6qdx

Vulnerability Instance