CVE-2020-10727: ActiveMQ Artemis has Insufficiently Protected Credentials

May 24, 2022 (updated July 7, 2026)

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the resetUsers operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.

References

bugzilla.redhat.com/show_bug.cgi?id=1827200
github.com/advisories/GHSA-q9g8-9hpp-xc82
issues.redhat.com/browse/ENTMQBR-3435
nvd.nist.gov/vuln/detail/CVE-2020-10727
security.netapp.com/advisory/ntap-20210827-0001

Code Behaviors & Features

Detect and mitigate CVE-2020-10727 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →