PT-2025-12536 · Apache+2 · Apache Commons Vfs+2

Marek Šunda · Published 2025-03-23 · Updated 2025-04-03 · CVE-2025-30474

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Commons VFS versions prior to 2.10.0

Description The issue is related to the exposure of sensitive information to an unauthorized actor in Apache Commons VFS. Specifically, the FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password.

Recommendations For versions prior to 2.10.0, upgrade to version 2.10.0, which fixes the issue by masking the password in the exception message.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-03215

CVE-2025-30474

GHSA-3936-3GX6-49C4

OESA-2025-1356

OESA-2025-1357

OPENSUSE-SU-2025:14929-1

OPENSUSE-SU-2025_1022-1

SUSE-SU-2025:1022-1

Affected Products

Apache Commons Vfs

Debian

Suse

References · 37

• https://osv.dev/vulnerability/OESA-2025-1356 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03215 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-30474 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-30474 · Security Note
• https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 · Vendor Advisory
• https://issues.apache.org/jira/browse/VFS-169 · Patch
• https://osv.dev/vulnerability/GHSA-3936-3gx6-49c4 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-30474 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1022-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30474 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14929-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-30474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30474 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27553 · Security Note