CVE-2023-45859

In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*

History

13 May 2025, 14:52

Type Values Removed Values Added
First Time Hazelcast
Hazelcast hazelcast
CPE cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
References () https://github.com/hazelcast/hazelcast/pull/25509 - () https://github.com/hazelcast/hazelcast/pull/25509 - Patch
References () https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66 - () https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66 - Vendor Advisory

29 Nov 2024, 17:15

Type Values Removed Values Added
CWE CWE-922
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.6

21 Nov 2024, 08:27

Type Values Removed Values Added
References () https://github.com/hazelcast/hazelcast/pull/25509 - () https://github.com/hazelcast/hazelcast/pull/25509 -
References () https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66 - () https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66 -
Summary
  • (es) En Hazelcast hasta 4.1.10, 4.2 hasta 4.2.8, 5.0 hasta 5.0.5, 5.1 hasta 5.1.7, 5.2 hasta 5.2.4 y 5.3 hasta 5.3.2, algunas operaciones de cliente no verifican los permisos correctamente, lo que permite a los usuarios autenticados acceder a los datos almacenados en el clúster.

28 Feb 2024, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-28 22:15

Updated : 2025-05-13 14:52


NVD link : CVE-2023-45859

Mitre link : CVE-2023-45859

CVE.ORG link : CVE-2023-45859


JSON object : View

Products Affected

hazelcast

  • hazelcast
CWE
CWE-922

Insecure Storage of Sensitive Information