CVE-2025-27391 – Apache ActiveMQ Artemis Sensitive Information Disclosure

The following table lists the changes that have been made to the
CVE-2025-27391 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Apr. 09, 2025

    Action Type Old Value New Value
    Added Description Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.

    This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.

    Users are recommended to upgrade to version 2.40.0, which fixes the issue.

    Added CVSS V4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-532
    Added Reference https://lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolps
Share the Post:

Related Posts