GitHub Advisoryadvisory · Maven

GHSA-pm4j-p7pm-fpvx Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File

MEDIUM Published 2025-04-09 Modified 2025-07-15 Official page ↗
Aliases
CVE-2025-27391
Ecosystem
Maven
Packages
org.apache.activemq:artemis-project
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2025-04-10

Affected packages

• Maven org.apache.activemq:artemis-project: >= 1.5.1, < 2.40.0 → fixed in 2.40.0

Description

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-27391 Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References