Description

In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.

Remediation

References

https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265

https://github.com/hazelcast/hazelcast

Related Vulnerabilities

CVE-2022-38398 Vulnerability in maven package org.apache.xmlgraphics:batik-bridge

CVE-2020-13937 Vulnerability in maven package org.apache.kylin:kylin

CVE-2023-47112 Vulnerability in maven package org.rundeck:rundeck

CVE-2023-45134 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates

CVE-2020-5407 Vulnerability in maven package org.springframework.security:spring-security-saml2-service-provider

Severity

Critical

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Product