CVE-2025-27391: apache artemis

csirt@kutim:~/threat-intel/cve/CVE-2025-27391

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Insertion of Sensitive Information into Log File pada apache artemis. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.

Rincian

Terbit di NVD: 9 April 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-532: Insertion of Sensitive Information into Log File
EPSS (30 hari): 0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	artemis	Versi 1.5.1 hingga sebelum 2.40.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolps issue tracking · mailing list · advisory vendor
http://www.openwall.com/lists/oss-security/2025/04/09/3 mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.