GHSA-xh6m-7cr7-xx66
Missing permission checks on Hazelcast client protocol
At a glance
- Published
- Updated
- CVE
- CVE-2023-45859
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Description
### Impact In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster. ### Patches Fix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1 ### Workarounds There is no known workaround.
Affected packages
| Package | Versions |
|---|---|
| Maven · com.hazelcast:hazelcast | introduced 0, last affected 4.1.10 |
| Maven · com.hazelcast:hazelcast | introduced 4.2, last affected 4.2.8 |
| Maven · com.hazelcast:hazelcast | introduced 5.0, last affected 5.0.5 |
| Maven · com.hazelcast:hazelcast | introduced 5.1, last affected 5.1.7 |
| Maven · com.hazelcast:hazelcast | introduced 5.2.0, fixed 5.2.5 |
| Maven · com.hazelcast:hazelcast | introduced 5.3.0, fixed 5.3.5 |
| Maven · com.hazelcast:hazelcast-all | introduced 0, last affected 4.1.10 |
| Maven · com.hazelcast:hazelcast-all | introduced 4.2, last affected 4.2.8 |
References
- https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-45859 ADVISORY
- https://github.com/hazelcast/hazelcast/pull/25509 WEB
- https://github.com/hazelcast/hazelcast PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |