Home

Description

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.

PUBLISHED Reserved 2025-02-24 | Published 2025-04-09 | Updated 2025-04-09 | Assigner apache




MEDIUM: 6.8CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Problem types

CWE-532 Insertion of Sensitive Information into Log File

Product status

Default status
unaffected

1.5.1 (semver) before 2.40.0
affected

Credits

Rafael Yanez Illescas <ryanezil@redhat.com> finder

References

www.openwall.com/lists/oss-security/2025/04/09/3

lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolps vendor-advisory

cve.org (CVE-2025-27391)

nvd.nist.gov (CVE-2025-27391)

Download JSON