Medium severity · published Apr 9, 2025
CVE-2025-27391
Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.
This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.
Users are recommended to upgrade to version 2.40.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache ActiveMQ Artemis · Apache Software Foundation
1.5.1 before 2.40.0 · source: vendor
AR
Artemis · Apache
1.5.1 before 2.40.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27391
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27391
Issue Tracking
https://lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolps
Mailing List
http://www.openwall.com/lists/oss-security/2025/04/09/3
More from Apache ActiveMQ Artemis
9.8
CVE-2026-57967
Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
9.8
CVE-2026-27446
Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
9.1
CVE-2026-49364
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
9.1
CVE-2026-67593
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
8.8
CVE-2023-50780
Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans