CVE-2025-30474

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-30474
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://issues.apache.org/jira/browse/VFS-169 Issue Tracking Patch
https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/03/23/2 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:commons_vfs:*:*:*:*:*:*:*:*
History

14 Jul 2025, 18:13

Type Values Removed Values Added
References () https://issues.apache.org/jira/browse/VFS-169 - () https://issues.apache.org/jira/browse/VFS-169 - Issue Tracking, Patch
References () https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 - () https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2025/03/23/2 - () http://www.openwall.com/lists/oss-security/2025/03/23/2 - Mailing List, Third Party Advisory
First Time Apache
Apache commons Vfs
CPE cpe:2.3:a:apache:commons_vfs:*:*:*:*:*:*:*:*

01 Apr 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.0
Summary
  • (es) Vulnerabilidad de exposición de información confidencial a un agente no autorizado en Apache Commons VFS. La clase FtpFileObject puede generar una excepción cuando no se encuentra un archivo, revelando la URI original en su mensaje, que puede incluir una contraseña. La solución consiste en ocultar la contraseña en el mensaje de excepción. Este problema afecta a Apache Commons VFS anteriores a la versión 2.10.0. Se recomienda actualizar a la versión 2.10.0, que soluciona el problema.

23 Mar 2025, 19:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/03/23/2 -

23 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-23 15:15

Updated : 2025-07-14 18:13

NVD link : CVE-2025-30474

Mitre link : CVE-2025-30474

CVE.ORG link : CVE-2025-30474

JSON object : View

Products Affected

apache

  • commons_vfs
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor