Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor

TRUNG BÌNH 5.0CVE-2025-30474 · GHSA-3936-3gx6-49c4 · Công bố 23/03/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-30474 là lỗ hổng mức TRUNG BÌNH (CVSS 5.0) ảnh hưởng org.apache.commons:commons-vfs2, commons vfs (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.89%, cao hơn 59.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.10.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.commons:commons-vfs2 Maven	`< 2.10.0`	`2.10.0`
commons vfs apache	`< 2.10.0`	`2.10.0`

Mô tả

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.

The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Mô tả của NVD

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.