CVE-2025-30474

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-30474
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.
CVSS

No CVSS.

References
Link Resource
http://www.openwall.com/lists/oss-security/2025/03/23/2 Mailing List Third Party Advisory
https://issues.apache.org/jira/browse/VFS-169 Issue Tracking Patch
https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:commons_vfs:*:*:*:*:*:*:*:*
History

14 Jul 2025, 18:13

Type Values Removed Values Added
First Time Apache commons Vfs
Apache
References () http://www.openwall.com/lists/oss-security/2025/03/23/2 - () http://www.openwall.com/lists/oss-security/2025/03/23/2 - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 - () https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 - Mailing List, Vendor Advisory
References () https://issues.apache.org/jira/browse/VFS-169 - () https://issues.apache.org/jira/browse/VFS-169 - Issue Tracking, Patch
CPE cpe:2.3:a:apache:commons_vfs:*:*:*:*:*:*:*:*

23 Mar 2025, 19:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/03/23/2 -
CWE CWE-200

23 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-23 15:15

Updated : 2025-07-14 18:13

NVD link : CVE-2025-30474

Mitre link : CVE-2025-30474

JSON object : View

Products Affected

apache

  • commons_vfs
CWE

No CWE.