CVE-2025-27427

A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0. Users are recommended to upgrade to version 2.40.0 which fixes the issue.

CVSS

No CVSS.

References

Link	Resource
https://lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8
http://www.openwall.com/lists/oss-security/2025/03/31/1

Configurations

No configuration.

History

02 Apr 2025, 22:15

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2025/03/31/1 -
Summary		(es) Existe una vulnerabilidad en Apache ActiveMQ Artemis que permite a un usuario con el permiso createDurableQueue o createNonDurableQueue modificar el tipo de enrutamiento compatible con dicha dirección, incluso si no tiene el permiso createAddress. Al combinar esta vulnerabilidad con el permiso de envío y la creación automática de colas, un usuario podría enviar un mensaje con un tipo de enrutamiento no compatible con la dirección, cuando en realidad debería rechazarse porque el usuario no tiene permiso para cambiar el tipo de enrutamiento. Este problema afecta a Apache ActiveMQ Artemis desde la versión 2.0.0 hasta la 2.39.0. Se recomienda actualizar a la versión 2.40.0, que soluciona el problema.

01 Apr 2025, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-01 08:15

Updated : 2025-04-02 22:15

NVD link : CVE-2025-27427

Mitre link : CVE-2025-27427

CVE.ORG link : CVE-2025-27427

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-27427", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-01T08:15:13.860", "references": [{"url": "https://lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/03/31/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue."}, {"lang": "es", "value": "Existe una vulnerabilidad en Apache ActiveMQ Artemis que permite a un usuario con el permiso createDurableQueue o createNonDurableQueue modificar el tipo de enrutamiento compatible con dicha direcci\u00f3n, incluso si no tiene el permiso createAddress. Al combinar esta vulnerabilidad con el permiso de env\u00edo y la creaci\u00f3n autom\u00e1tica de colas, un usuario podr\u00eda enviar un mensaje con un tipo de enrutamiento no compatible con la direcci\u00f3n, cuando en realidad deber\u00eda rechazarse porque el usuario no tiene permiso para cambiar el tipo de enrutamiento. Este problema afecta a Apache ActiveMQ Artemis desde la versi\u00f3n 2.0.0 hasta la 2.39.0. Se recomienda actualizar a la versi\u00f3n 2.40.0, que soluciona el problema."}], "lastModified": "2025-04-02T22:15:19.083", "sourceIdentifier": "security@apache.org"}