CVE-2025-27391CWE-532

Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log

Medium · published April 9, 2025

CVSS v4.0
6.8
EPSS
0%
Percentile
36.7
In the wild
Unconfirmed
What it is

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.

This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.

Users are recommended to upgrade to version 2.40.0, which fixes the issue.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00434 · 36.7th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-04-09T14:42Z
EPSS history
Timeline
  • 09 APR 14:42Z
    Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log
    cvelistv5