Vulnerability Description
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Activemq Artemis | >= 1.5.1, < 2.40.0 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolpsIssue TrackingMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2025/04/09/3Mailing ListThird Party Advisory
FAQ
What is CVE-2025-27391?
CVE-2025-27391 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.Conf...
How severe is CVE-2025-27391?
CVE-2025-27391 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-27391?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Activemq Artemis.