Sensitive Info Logging in Apache ActiveMQ Artemis <2.40.0
CVE-2025-27391 Published on April 9, 2025

Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.

Vendor Advisory NVD

Weakness Type

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.


Products Associated with CVE-2025-27391

stack.watch emails you whenever new vulnerabilities are published in Apache ActiveMQ or Apache Activemq Artemis. Just hit a watch button to start following.

Apache ActiveMQ
 
Apache Activemq Artemis
 

Affected Versions

Apache Software Foundation Apache ActiveMQ Artemis:

Exploit Probability

EPSS
0.26%
Percentile
49.39%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.