Description
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
Remediation
References
https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265
https://github.com/hazelcast/hazelcast
Related Vulnerabilities
CVE-2020-5405 Vulnerability in maven package org.springframework.cloud:spring-cloud-config-server
CVE-2019-1003099 Vulnerability in maven package org.jenkins-ci.plugins:openid
CVE-2016-3084 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-login
CVE-2014-3612 Vulnerability in maven package org.apache.activemq:activemq-all
CVE-2021-22135 Vulnerability in maven package org.elasticsearch:elasticsearch