PT-2025-14017 · Apache · Apache Activemq Artemis

Dain Lee + 4 · Publicado 2025-03-31 · Atualizado 2026-06-15 · CVE-2025-27427

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Média

Vetor base

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions 2.0.0 through 2.39.0

Description A vulnerability exists in Apache ActiveMQ Artemis where a user with the createDurableQueue or createNonDurableQueue permission on an address can update the routing-type supported by that address, even without the createAddress permission. This can be exploited when combined with the send permission and automatic queue creation, allowing a user to send a message with a routing-type not supported by the address, which should be rejected due to lack of permission to change the routing-type.

Recommendations For Apache ActiveMQ Artemis versions 2.0.0 through 2.39.0, upgrade to version 2.40.0 to fix the issue.

Correção

DoS

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2025-08197

CVE-2025-27427

GHSA-3W85-5P9G-H334

Produtos afetados

Apache Activemq Artemis

Referências · 17

• https://github.com/apache/activemq-artemis · Nota
• https://github.com/apache/activemq-artemis/commit/2216a75a57f098295abb283d556c8b8bda91324d · Nota
• https://github.com/apache/activemq-artemis/commit/6ab458015689303db8878941abe1bc973299fc2e · Nota
• https://issues.apache.org/jira/browse/ARTEMIS-5346 · Nota
• https://twitter.com/oss_security/status/1906804353429598441 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2025/03/31/1 · Nota
• https://t.me/cveNotify/167387 · Publicação no Telegram
• https://lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-27427 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3w85-5p9g-h334 · Aviso do Fabricante
• https://t.me/cvetracker/20460 · Publicação no Telegram
• https://t.me/cvedetector/21740 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1906977380997968341 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-27427 · Nota de Segurança
• https://t.me/cvenotify/128831 · Publicação no Telegram