CVE-2023-45859

In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/hazelcast/hazelcast/pull/25509	Patch
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66	Vendor Advisory
https://github.com/hazelcast/hazelcast/pull/25509	Patch
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hazelcast:hazelcast::::::::
	cpe:2.3:a:hazelcast:hazelcast::::::::
	cpe:2.3:a:hazelcast:hazelcast::::::::
	cpe:2.3:a:hazelcast:hazelcast::::::::
	cpe:2.3:a:hazelcast:hazelcast::::::::
	cpe:2.3:a:hazelcast:hazelcast::::::::

History

13 May 2025, 14:52

Type	Values Removed	Values Added
CPE		cpe:2.3:a:hazelcast:hazelcast::::::::
First Time		Hazelcast Hazelcast hazelcast
References	~~() https://github.com/hazelcast/hazelcast/pull/25509 -~~	() https://github.com/hazelcast/hazelcast/pull/25509 - Patch
References	~~() https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66 -~~	() https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66 - Vendor Advisory

Information

Published : 2024-02-28 22:15

Updated : 2025-05-13 14:52

NVD link : CVE-2023-45859

Mitre link : CVE-2023-45859

CVE.ORG link : CVE-2023-45859

JSON object : View

Products Affected

hazelcast

hazelcast

CWE

CWE-922

Insecure Storage of Sensitive Information

{"id": "CVE-2023-45859", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2024-02-28T22:15:26.070", "references": [{"url": "https://github.com/hazelcast/hazelcast/pull/25509", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/hazelcast/hazelcast/pull/25509", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-922"}]}], "descriptions": [{"lang": "en", "value": "In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster."}, {"lang": "es", "value": "En Hazelcast hasta 4.1.10, 4.2 hasta 4.2.8, 5.0 hasta 5.0.5, 5.1 hasta 5.1.7, 5.2 hasta 5.2.4 y 5.3 hasta 5.3.2, algunas operaciones de cliente no verifican los permisos correctamente, lo que permite a los usuarios autenticados acceder a los datos almacenados en el cl\u00faster."}], "lastModified": "2025-05-13T14:52:22.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A27DC77-9472-4170-A7D0-CAF88A8ED742", "versionEndIncluding": "4.1.10"}, {"criteria": "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAEC1A2F-E2E2-40A6-9366-1127CB335BF0", "versionEndIncluding": "4.2.8", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C03C4EBA-6110-4BE7-AEAD-D0B844D68EF5", "versionEndIncluding": "5.0.5", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B34E82BE-949F-464C-B2D9-8E7C69BD3636", "versionEndIncluding": "5.1.7", "versionStartIncluding": "5.1.0"}, {"criteria": "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46B51F89-569F-415E-A84E-CF8240D57D2A", "versionEndExcluding": "5.2.5", "versionStartIncluding": "5.2.0"}, {"criteria": "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BAF02F2-6A4D-40D1-AFBB-F152327FECE7", "versionEndExcluding": "5.3.5", "versionStartIncluding": "5.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}