GitHub Advisoryadvisory · Maven

GHSA-3936-3gx6-49c4 Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor

MEDIUM Published 2025-03-23 Modified 2025-03-25 Official page ↗
Aliases
CVE-2025-30474
Ecosystem
Maven
Packages
org.apache.commons:commons-vfs2
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200
Reviewed
2025-03-25

Affected packages

• Maven org.apache.commons:commons-vfs2: < 2.10.0 → fixed in 2.10.0

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-30474 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References