{"id":"CVE-2025-27391","aliases":["EUVD-2025-10665","GHSA-pm4j-p7pm-fpvx","ROOT-APP-MAVEN-CVE-2025-27391"],"status":"published","title":"Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log","description":"Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.\n\nThis issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.\n\nUsers are recommended to upgrade to version 2.40.0, which fixes the issue.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00443,"percentile":0.38977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2025-04-09T14:42:32Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"Maven","package":"org.apache.activemq:artemis-project","fixed_in":["2.40.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.activemq:artemis-project","fixed_in":["2.37.0-root.io.1","2.37.0-root.io.2","2.37.0-root.io.3","2.33.0-root.io.3","2.33.0-root.io.4","2.33.0-root.io.5"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.activemq:artemis-project","fixed_in":["2.37.0-aikido.3","2.33.0-aikido.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:artemis-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1"},{"fixed":"2.40.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:artemis-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1"},{"fixed":"2.40.0"}]}],"versions":["2.33.0","2.34.0","2.35.0","2.36.0","2.37.0","2.38.0","2.39.0"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.activemq:artemis-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.0-root.io.1"},{"fixed":"2.37.0-root.io.2"},{"fixed":"2.37.0-root.io.3"},{"fixed":"2.33.0-root.io.3"},{"fixed":"2.33.0-root.io.4"},{"fixed":"2.33.0-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.activemq:artemis-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.0-aikido.3"},{"fixed":"2.33.0-aikido.5"}]}]}],"products":[{"vendor":"apache","product":"artemis"},{"vendor":"apache software foundation","product":"apache activemq artemis"}],"references":[{"url":"https://lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolps","tags":["vendor-advisory","Issue Tracking","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/09/3","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27391","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pm4j-p7pm-fpvx"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27391.json","tags":["advisory"]},{"url":"https://github.com/apache/activemq-artemis","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-27391","title":"Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log","description":"Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.\n\nThis issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.\n\nUsers are recommended to upgrade to version 2.40.0, which fixes the issue.","status":"published","published":"2025-04-09T14:42:32.504Z","modified":"2025-04-09T17:02:46.727Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-10665","description":"Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.\n\nThis issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.\n\nUsers are recommended to upgrade to version 2.40.0, which fixes the issue.","status":"published","published":"2025-04-09T14:42:32Z","modified":"2025-04-09T17:02:46Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:38.263259Z"}],"ghsa":[{"id":"GHSA-pm4j-p7pm-fpvx","title":"Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File","description":"Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.\n\nThis issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.\n\nUsers are recommended to upgrade to version 2.40.0, which fixes the issue.","status":"published","published":"2025-04-09T15:32:23Z","modified":"2025-07-15T00:27:14Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:38:49.837727Z"}],"nvd":[{"id":"CVE-2025-27391","description":"Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.\n\nThis issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.\n\nUsers are recommended to upgrade to version 2.40.0, which fixes the issue.","status":"published","published":"2025-04-09T15:16:02.09Z","modified":"2026-06-17T09:03:29.913Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:11:00.087098Z"}],"osv":[{"id":"CVE-2025-27391","title":"Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log","description":"Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.\n\nThis issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.\n\nUsers are recommended to upgrade to version 2.40.0, which fixes the issue.","status":"published","published":"2025-04-09T14:42:32.504Z","modified":"2026-10-28T02:31:06.509359248Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"GHSA-pm4j-p7pm-fpvx","title":"Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File","description":"Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.\n\nThis issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.\n\nUsers are recommended to upgrade to version 2.40.0, which fixes the issue.","status":"published","published":"2025-04-09T15:32:23Z","modified":"2025-07-15T01:05:23.628646Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-27391","title":"CVE-2025-27391 in io.root.org.apache.activemq:artemis-project - Patched by Root","description":"Root has patched CVE-2025-27391 in the io.root.org.apache.activemq:artemis-project package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-02T19:10:44Z","modified":"2026-08-03T01:15:05.418166093Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}