CVE-2020-10727

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the resetUsers operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.

Published: Jun 26, 2020
Updated: May 9, 2024
CVE: CVE-2020-10727
GHSA: GHSA-q9g8-9hpp-xc82
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.5
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Low
Score: 2.1
AV:L/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-522
CWE-312

OWASP TOP 10:

A2 - Broken Authentication
A3 - Sensitive Data Exposure

Affected Software
References

Software	From	Fixed in
apache / activemq_artemis	2.7.0	2.12.0.x
org.apache.activemq / artemis-commons	2.7.0	2.13.0

https://bugzilla.redhat.com/show_bug.cgi?id=1827200
https://issues.redhat.com/browse/ENTMQBR-3435
https://security.netapp.com/advisory/ntap-20210827-0001/

Vulnerability Database

CVE-2020-10727

Deep Security Visibility Without the Complexity