CVSS 3.1
7.6 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:LCVE-2023-45859
High (7.6) in hazelcast hazelcast. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in com.hazelcast:hazelcast 5.2.5, 5.3.5.
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
- CWE
- CWE-922
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hazelcast:hazelcast
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xh6m-7cr7-xx66 | Maven | com.hazelcast:hazelcast | <=4.1.10 | no fix published |
| GHSA-xh6m-7cr7-xx66 | Maven | com.hazelcast:hazelcast | >=4.2 <=4.2.8 | no fix published |
| GHSA-xh6m-7cr7-xx66 | Maven | com.hazelcast:hazelcast | >=5.0 <=5.0.5 | no fix published |
| GHSA-xh6m-7cr7-xx66 | Maven | com.hazelcast:hazelcast | >=5.1 <=5.1.7 | no fix published |
| GHSA-xh6m-7cr7-xx66 | Maven | com.hazelcast:hazelcast | >=5.2.0 <5.2.5 | 5.2.5 |
| GHSA-xh6m-7cr7-xx66 | Maven | com.hazelcast:hazelcast | >=5.3.0 <5.3.5 | 5.3.5 |
| GHSA-xh6m-7cr7-xx66 | Maven | com.hazelcast:hazelcast-all | <=4.1.10 | no fix published |
| GHSA-xh6m-7cr7-xx66 | Maven | com.hazelcast:hazelcast-all | >=4.2 <=4.2.8 | no fix published |