CVE-2025-27391mediumCWE-532

CVE-2025-27391: falha de média gravidade em Apache ActiveMQ Artemis

Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log

Publicada em

Seguir esta CVE+ Monitorar Apache ActiveMQ Artemis+ Monitorar org.apache.activemq:artemis-project

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.4%
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Produtos afetados
Apache Software Foundation · Apache ActiveMQ Artemis
CVEs relacionadas — Apache ActiveMQ Artemis

No mesmo produto, das mais perigosas para as menos.

CVE-2023-50780HIGHApache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansEPSS 17.5%CVE-2026-27446CRITICALApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationEPSS 11.4%CVE-2021-26118—Flaw in ActiveMQ Artemis OpenWire supportEPSS 3.9%CVE-2022-23913—Apache ActiveMQ Artemis DoSEPSS 2.7%CVE-2022-35278—HTML Injection in ActiveMQ Artemis Web ConsoleEPSS 1.7%CVE-2026-57967CRITICALApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentEPSS 1.5%