Description

In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.

Remediation

References

https://github.com/hazelcast/hazelcast/pull/24266

Related Vulnerabilities

CVE-2017-5662 Vulnerability in maven package org.apache.xmlgraphics:batik-dom

CVE-2022-31180 Vulnerability in npm package shescape

CVE-2017-16137 Vulnerability in maven package org.webjars.npm:debug

CVE-2020-15841 Vulnerability in maven package com.liferay:com.liferay.portal.settings.authentication.ldap.web

CVE-2019-10759 Vulnerability in npm package safer-eval

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Patch