CVE-2025-27391
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The vulnerability in Apache ActiveMQ Artemis involves the insertion of sensitive information into the log file. All broker property values are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has debug level enabled.
Risk Assessment
The organization may expose sensitive data, leading to privacy and security breaches. Restricting log access to only trusted users is crucial.
Recommendation
It is recommended to upgrade to version 2.40.0, which fixes the issue. Additionally, access to logs should be restricted to trusted users only.
Original NVD description (English source)
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.