CVE-2025-30474

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Reserved 2025-03-22 | Published 2025-03-23 | Updated 2025-04-01 | Assigner apache

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

Any version before 2.10.0
affected

Credits

Marek Šunda finder

References

issues.apache.org/jira/browse/VFS-169 related

lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 vendor-advisory

cve.org (CVE-2025-30474)

nvd.nist.gov (CVE-2025-30474)

Download JSON