What is the CVSS score of CVE-2025-30474?

CVE-2025-30474 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Commons Vfs are affected by CVE-2025-30474?

CVE-2025-30474 presents moderate security risk, a information exposure vulnerability rated CVSS 5.0. Sensitive information could be exposed to unauthorized parties.. A patch is available.

How to fix or mitigate CVE-2025-30474?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Commons Vfs CVE-2025-30474

MEDIUM

Information Exposure (CWE-200)

2025-03-23 security@apache.org

Apache Information Disclosure Commons Vfs Suse

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

SUSE

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:32 vuln.today

Patch released

Mar 28, 2026 - 18:32 nvd

Patch available

CVE Published

Mar 23, 2025 - 15:15 nvd

MEDIUM 5.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

512 maven packages depend on org.apache.commons:commons-vfs2 (92 direct, 420 indirect)

Ecosystem-wide dependent count for version 2.10.0.

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.

The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

AnalysisAI

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue. Affected products include: Apache Commons Vfs. Version information: before 2.10.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.

More in Commons Vfs

View all

CVE-2025-27553 HIGH This Week

7.5 Mar 23

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. Rated high severity (CVSS 7.5), this vulnerab

Same weakness CWE-200 – Information Exposure

View all

CVE-2016-6415 HIGH POC

7.5

CVE-2013-7331 MEDIUM POC

6.5

CVE-2025-31125 MEDIUM POC

5.3

CVE-2025-11749 CRITICAL POC

9.8

CVE-2017-16894 HIGH POC

7.5

CVE-2017-11165 CRITICAL POC

9.8

CVE-2016-2388 MEDIUM POC

5.3

CVE-2016-1561 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed

CVE-2025-30474 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 15.3	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed

Commons Vfs CVE-2025-30474

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Commons Vfs

Same weakness CWE-200 – Information Exposure

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code