Vulnerability · Published Apr 9, 2025 · Assigned by apache
CVE-2025-27391Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log
Medium 6.8
In plain English
A medium-severity sensitive data in logs in Apache ActiveMQ Artemis from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.activemq:artemis-project | 2.40.0 | GHSA-pm4j-p7pm-fpvx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ Artemis | 1.5.1 – before 2.40.0 |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N