PT-2025-14017 · Apache · Apache Activemq Artemis

Dain Lee + 4 · Published 2025-03-31 · Updated 2025-07-14 · CVE-2025-27427

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions 2.0.0 through 2.39.0

Description A vulnerability exists in Apache ActiveMQ Artemis where a user with the createDurableQueue or createNonDurableQueue permission on an address can update the routing-type supported by that address, even without the createAddress permission. This can be exploited when combined with the send permission and automatic queue creation, allowing a user to send a message with a routing-type not supported by the address, which should be rejected due to lack of permission to change the routing-type.

Recommendations For Apache ActiveMQ Artemis versions 2.0.0 through 2.39.0, upgrade to version 2.40.0 to fix the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-08197

CVE-2025-27427

GHSA-3W85-5P9G-H334

Affected Products

Apache Activemq Artemis

References · 16

• https://lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27427 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08197 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27427 · Security Note
• https://osv.dev/vulnerability/GHSA-3w85-5p9g-h334 · Vendor Advisory
• https://github.com/apache/activemq-artemis · Note
• https://github.com/apache/activemq-artemis/commit/6ab458015689303db8878941abe1bc973299fc2e · Note
• https://github.com/apache/activemq-artemis/commit/2216a75a57f098295abb283d556c8b8bda91324d · Note
• https://t.me/cvenotify/117167 · Telegram Post
• https://twitter.com/oss_security/status/1906804353429598441 · Twitter Post
• https://t.me/cvetracker/20460 · Telegram Post
• https://t.me/cvenotify/128831 · Telegram Post
• https://t.me/cvedetector/21740 · Telegram Post
• https://twitter.com/CVEnew/status/1906977380997968341 · Twitter Post
• https://issues.apache.org/jira/browse/ARTEMIS-5346 · Note