CVE-2025-27427

Katalog CVE

CVSS 4.3 · Medium EPSS 0,64%

Kerentanan Incorrect Authorization pada apache artemis. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0. Users are recommended to upgrade to version 2.40.0 which fixes the issue.

Rincian

Terbit di NVD

1 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/03/31/1 mailing list · advisory pihak ketiga