CVE-2025-27427

published 2025-04-01

CVE-2025-27427: A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the…

low 2.3 CVSS 4.0

AV N AC L AT P PR L UI N VC N VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.

This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.

Users are recommended to upgrade to version 2.40.0 which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	activemq_artemis	>= 2.0.0 < 2.40.0	2.40.0
apache_software_foundation	apache_activemq_artemis	2.0.0 – 2.39.0	—

CWE-863