PT-2025-15697 · Apache · Apache Activemq Artemis

Rafael Yanez Illescas · Published 2025-04-09 · Updated 2026-06-15 · CVE-2025-27391

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ Artemis versions 1.5.1 through 2.39.x

Description: The issue concerns the insertion of sensitive information into log files. When the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled, all values of the broker properties are logged, potentially exposing sensitive data. This can be mitigated by restricting log access to only trusted users.

Recommendations: For Apache ActiveMQ Artemis versions 1.5.1 through 2.39.x, upgrade to version 2.40.0, which fixes the issue. As a temporary workaround, consider restricting log access to only trusted users to minimize the risk of sensitive information exposure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-27391

GHSA-PM4J-P7PM-FPVX

Affected Products

Apache Activemq Artemis

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-27391 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27391 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pm4j-p7pm-fpvx · Vendor Advisory
• https://lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolps · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2025-27391 · Vendor Advisory
• https://github.com/apache/activemq-artemis · Note
• https://t.me/cvenotify/118486 · Telegram Post
• https://t.me/cveNotify/167388 · Telegram Post
• https://t.me/cvenotify/128832 · Telegram Post
• https://t.me/cvedetector/22561 · Telegram Post
• https://twitter.com/oss_security/status/1909979057543840238 · Twitter Post
• http://openwall.com/lists/oss-security/2025/04/09/3 · Note
• https://twitter.com/CVEnew/status/1910296126823313622 · Twitter Post