CVE-2020-10727 ActiveMQ Artemis has Insufficiently Protected Credentials

What is CVE-2020-10727?

CVE-2020-10727 is a medium-severity vulnerability in Netapp Oncommand Workflow Automation, published on 26 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.

Weakness: CWE-522, CWE-312

Which versions are affected by CVE-2020-10727?

2 open source packages ship an affected version, including org.apache.activemq:artemis-commons. It affects 2 products.

Products include Apache Artemis, Netapp Oncommand Workflow Automation.

How do I fix CVE-2020-10727?

Upgrade org.apache.activemq:artemis-commons to 2.13.0 or later.

Is CVE-2020-10727 being exploited?

There is no known exploitation of CVE-2020-10727 in the wild and no public exploit code.

Other vulnerabilities in Netapp Oncommand Workflow Automation

• CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Critical 9.8
• CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Critical 9.3
• CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis Critical 9.1
• CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis Critical 9.1
• CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans High 8.8

All Netapp Oncommand Workflow Automation vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q9g8-9hpp-xc82.