CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2023-33265
High (8.8) in hazelcast. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in com.hazelcast:hazelcast 5.0.5, 5.1.7, 5.2.4.
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hazelcast:hazelcast
- hazelcast:imdg
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c5vj-wp4v-mmvx | Maven | com.hazelcast:hazelcast | >=5.2.0 <5.2.4 | 5.2.4 |
| GHSA-c5vj-wp4v-mmvx | Maven | com.hazelcast:hazelcast | >=5.1.0 <5.1.7 | 5.1.7 |
| GHSA-c5vj-wp4v-mmvx | Maven | com.hazelcast:hazelcast | <5.0.5 | 5.0.5 |
| GHSA-c5vj-wp4v-mmvx | Maven | com.hazelcast:hazelcast-enterprise | >=5.2.0 <5.2.4 | 5.2.4 |
| GHSA-c5vj-wp4v-mmvx | Maven | com.hazelcast:hazelcast-enterprise | >=5.1.0 <5.1.7 | 5.1.7 |
| GHSA-c5vj-wp4v-mmvx | Maven | com.hazelcast:hazelcast-enterprise | <5.0.5 | 5.0.5 |