Is CVE-2020-10727 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-10727 being exploited in the wild.

How severe is CVE-2020-10727?

Medium severity, with a CVSS score of 5.5, published 24 May 2022.

Which products and versions are affected?

org.apache.activemq:artemis-commons (Maven) >= 2.7.0, <= 2.12.0, ECOSYSTEM:introduced=2.7.0,fixed=2.13.0.

Is there a fix for CVE-2020-10727?

Yes. org.apache.activemq:artemis-commons (Maven): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-10727 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2020-10727?

Check whether you run org.apache.activemq:artemis-commons (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-10727: Apache ActiveMQ Artemis plaintext password storage in resetUsers operation

Q: Is there a fix for CVE-2020-10727?

Yes. org.apache.activemq:artemis-commons (Maven): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-10727 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2020-10727?

Check whether you run org.apache.activemq:artemis-commons (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-10727 · Severity: medium · CVSS 5.5 · Published 2022-05-24

Apache ActiveMQ Artemis, a high-performance message broker, contains a security flaw where user passwords may be stored in plain text on the server's disk. This occurs when an administrator uses the 'resetUsers' management command. A local attacker with access to the server's file system could read these credentials, potentially leading to unauthorized access to the messaging system and sensitive data.

Vendors: Maven.

Quick answers

Is CVE-2020-10727 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-10727 being exploited in the wild.
How severe is CVE-2020-10727?: Medium severity, with a CVSS score of 5.5, published 24 May 2022.
Which products and versions are affected?: org.apache.activemq:artemis-commons (Maven) >= 2.7.0, <= 2.12.0, ECOSYSTEM:introduced=2.7.0,fixed=2.13.0.
Is there a fix for CVE-2020-10727?: Yes. org.apache.activemq:artemis-commons (Maven): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-10727 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2020-10727?: Check whether you run org.apache.activemq:artemis-commons (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.activemq:artemis-commons (Maven): upgrade to 2.13.0 or later

# set org.apache.activemq:artemis-commons to 2.13.0 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the Apache ActiveMQ Artemis management API (versions 2.7.0 through 2.12.0) due to improper handling of credentials during the 'resetUsers' operation. When this specific operation is invoked, the application inadvertently writes passwords in cleartext to the 'etc/artemis-users.properties' shadow file instead of using secure hashing. A local attacker with low privileges who can read the file system can retrieve these plaintext passwords. This issue is classified under CWE-312 (Cleartext Storage of Sensitive Information). A fix is available in version 2.13.0, and a suggested mitigation is to use the broker instance CLI ('artemis user reset') which is not affected.

Affected products

Apache ActiveMQ Artemis 2.7.0 - 2.12.0

Identifiers

CVE-2020-10727
GHSA-q9g8-9hpp-xc82

Timeline

2020-04-23: disclosed: Initial report to Red Hat Bugzilla
2020-06-25: patched: Red Hat AMQ errata released
2020-06-26: advisory: NVD published CVE-2020-10727
2022-05-24: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.