CVE-2020-10727
published 2020-06-26CVE-2020-10727: A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.69%
48.7th percentile
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | artemis | 2.7.0 – 2.12.0 | — |
| red_hat | activemq_artemis | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nsufficiently Protected Credentials in ActiveMQ Artemis
osv·2022-05-24
CVE-2020-10727 [MEDIUM] nsufficiently Protected Credentials in ActiveMQ Artemis
nsufficiently Protected Credentials in ActiveMQ Artemis
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
GHSA
nsufficiently Protected Credentials in ActiveMQ Artemis
ghsa·2022-05-24
CVE-2020-10727 [MEDIUM] CWE-312 nsufficiently Protected Credentials in ActiveMQ Artemis
nsufficiently Protected Credentials in ActiveMQ Artemis
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
Red Hat
broker: resetUsers operation stores password in plain text
vendor_redhat·2020-06-25·CVSS 5.5
CVE-2020-10727 [MEDIUM] CWE-522 broker: resetUsers operation stores password in plain text
broker: resetUsers operation stores password in plain text
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
Mitigation: When resetting a user an alternative is to use the broke
No detection rules found.
No public exploits indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1827200https://issues.redhat.com/browse/ENTMQBR-3435https://security.netapp.com/advisory/ntap-20210827-0001/https://bugzilla.redhat.com/show_bug.cgi?id=1827200https://issues.redhat.com/browse/ENTMQBR-3435https://security.netapp.com/advisory/ntap-20210827-0001/
2020-06-26
Published