Homepage

Information Exposure Affecting commons-vfs package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-COMMONSVFS-9511124
  • published24 Mar 2025
  • disclosed23 Mar 2025
Report a new vulnerability Found a mistake?

Introduced: 23 Mar 2025

NewCVE-2025-30474  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

There is no fixed version for Debian:12 commons-vfs.

NVD Description

Note: Versions mentioned in the description apply only to the upstream commons-vfs package and not the commons-vfs package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.

The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.