CVE-2023-33264
En bref
- Source
- NVD
- EPSS
- EPSS 0.72 % · centile 54 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
Faiblesses (CWE)
- CWE-522 — Identifiants insuffisamment protégés
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-5gj6-62g7-vmgf — Hazelcast vulnerable to unmasked password exposure
Références européennes
- ENISA EUVD · EUVD-2023-1474
- GCVE · GCVE-0-2023-33264
Configurations affectées (CPE NVD)
cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*≤ 5.0.4cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*≥ 5.1 < 5.1.6cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*≥ 5.2 ≤ 5.2.3
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |