CVE-2025-30474 Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message

🗓️ 23 Mar 2025 14:15:51Reported by apacheType

CVE-2025-30474 in Apache Commons VFS reveals password in error message on FTP file not found.

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS, which affects IBM watsonx.data	1 Sep 202514:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities reported in YAJSW service shipped in IBM WebSphere eXtreme Scale Liberty Deployment	14 Oct 202518:10	–	ibm
Tenable Nessus	Amazon Linux 2 : apache-commons-vfs (ALAS-2025-2819)	17 Apr 202500:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : apache-commons-vfs2 (SUSE-SU-2025:1022-1)	27 Mar 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-30474	27 Aug 202500:00	–	nessus
Amazon	Important: apache-commons-vfs	16 Apr 202500:00	–	amazon
Amazon	Important: apache-commons-vfs	16 Apr 202500:00	–	amazon
BDU FSTEC	The vulnerability of the FtpFileObject class, a common API for accessing various file systems through Apache Commons VFS, allows attackers to gain unauthorized access to protected information.	3 Jun 202500:00	–	bdu_fstec
Circl	CVE-2025-30474	23 Mar 202516:50	–	circl
CNNVD	Apache Commons VFS 安全漏洞	23 Mar 202500:00	–	cnnvd

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.commons:commons-vfs2",
    "product": "Apache Commons VFS",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.10.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4
issues	www.issues.apache.org/jira/browse/VFS-169

23 Mar 2025 14:15Current

EPSS0.00109

CWE-200