CVE-2025-27391

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.

This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.

Users are recommended to upgrade to version 2.40.0, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache ActiveMQ Artemis	>= 1.5.1, < 2.40.0

References

https://lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolpsIssue Tracking, Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/04/09/3Mailing List, Third Party Advisory

Timeline

Published: Apr 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-273927.2A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitiz CVE-2025-273937.2A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitiz CVE-2025-273947.2A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitiz CVE-2025-273956.5A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit t CVE-2025-273968.8A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit t CVE-2025-273973.8A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit u CVE-2025-273982.7A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly neutral CVE-2025-273995.3Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain CVE-2025-27407.3A vulnerability classified as critical has been found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of t CVE-2025-274002.9Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commer CVE-2025-274014.6Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue h CVE-2025-274024.6Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on track