CVE-2020-10727
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A flaw was found in ActiveMQ Artemis from versions 2.7.0 to 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
Risk Assessment
This vulnerability poses a risk of exposing user passwords, which could lead to unauthorized access to the system. Organizations should be aware of the potential security threats related to data exposure.
Recommendation
It is recommended to upgrade ActiveMQ Artemis to a version above 2.12.0 and to monitor access to the shadow file to minimize the risk of data leakage.
Original NVD description (English source)
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.