Vulnerabilites related to hazelcast - hazelcast
Vulnerability from fkie_nvd
Published
2020-11-09 22:15
Modified
2024-11-21 05:19
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.
References
cve@mitre.orghttps://docs.hazelcast.org/docs/ern/index.html#4-0-3Release Notes, Vendor Advisory
cve@mitre.orghttps://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-BypassVendor Advisory
cve@mitre.orghttps://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-BypassVendor Advisory
cve@mitre.orghttps://jet-start.sh/blog/2020/10/23/jet-43-is-releasedVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://docs.hazelcast.org/docs/ern/index.html#4-0-3Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-BypassVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-BypassVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://jet-start.sh/blog/2020/10/23/jet-43-is-releasedVendor Advisory
Impacted products
Vendor Product Version
hazelcast hazelcast *
hazelcast jet *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "06DB8128-3063-4CB2-BB6F-6AFEA507E551",
                     versionEndExcluding: "4.0.3",
                     versionStartIncluding: "4.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:jet:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "F829E074-7D1E-4A91-9741-B776F6404202",
                     versionEndIncluding: "4.2",
                     versionStartIncluding: "4.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.",
      },
      {
         lang: "es",
         value: "El método de autenticación LDAP en LdapLoginModule en Hazelcast IMDG Enterprise versiones 4.x anteriores a 4.0.3, y Jet Enterprise versiones 4.x anteriores a 4.2, no comprueba apropiadamente la contraseña en algunos escenarios de system-user-dn. Como resultado, los usuarios (clients/members) pueden ser autenticados incluso si proporcionan contraseñas no válidas",
      },
   ],
   id: "CVE-2020-26168",
   lastModified: "2024-11-21T05:19:25.937",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-11-09T22:15:13.257",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://docs.hazelcast.org/docs/ern/index.html#4-0-3",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://jet-start.sh/blog/2020/10/23/jet-43-is-released",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://docs.hazelcast.org/docs/ern/index.html#4-0-3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://jet-start.sh/blog/2020/10/23/jet-43-is-released",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-287",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-05-22 01:15
Modified
2024-11-21 08:05
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
References
cve@mitre.orghttps://github.com/hazelcast/hazelcast/pull/24266Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/hazelcast/hazelcast/pull/24266Patch
Impacted products
Vendor Product Version
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A12D1018-C3A9-47B4-8930-99168FE6A6DD",
                     versionEndIncluding: "5.0.4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F5E94137-3D43-4D58-96FB-8C1738BFD37A",
                     versionEndExcluding: "5.1.6",
                     versionStartIncluding: "5.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1CE94172-E7C3-4FC8-B95E-8298AD3240BF",
                     versionEndIncluding: "5.2.3",
                     versionStartIncluding: "5.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.",
      },
   ],
   id: "CVE-2023-33264",
   lastModified: "2024-11-21T08:05:17.100",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-05-22T01:15:44.333",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
         ],
         url: "https://github.com/hazelcast/hazelcast/pull/24266",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://github.com/hazelcast/hazelcast/pull/24266",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-522",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2022-03-03 22:15
Modified
2024-11-21 06:38
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
References
security@huntr.devhttps://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748Patch, Third Party Advisory
security@huntr.devhttps://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563Exploit, Issue Tracking, Patch, Third Party Advisory
Impacted products
Vendor Product Version
hazelcast hazelcast 5.1


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:5.1:beta1:*:*:*:*:*:*",
                     matchCriteriaId: "8AD19A9D-733A-4066-8C82-97DE2B8EB64E",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.",
      },
      {
         lang: "es",
         value: "Restricción inadecuada de la referencia de entidad externa XML en el repositorio GitHub hazelcast/hazelcast en 5.1-BETA-1",
      },
   ],
   id: "CVE-2022-0265",
   lastModified: "2024-11-21T06:38:15.933",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 7.3,
               baseSeverity: "HIGH",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.4,
            source: "security@huntr.dev",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-03-03T22:15:08.577",
   references: [
      {
         source: "security@huntr.dev",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748",
      },
      {
         source: "security@huntr.dev",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563",
      },
   ],
   sourceIdentifier: "security@huntr.dev",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-611",
            },
         ],
         source: "security@huntr.dev",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-611",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-02-16 10:15
Modified
2025-03-27 14:24
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.
References
cve@mitre.orghttps://github.com/hazelcast/hazelcast/pull/25348Patch
cve@mitre.orghttps://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hazelcast/hazelcast/pull/25348Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99Vendor Advisory
Impacted products
Vendor Product Version
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "28E1EBD6-4B88-42FB-9152-D7A13D08FF60",
                     versionEndIncluding: "5.1.7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "46B51F89-569F-415E-A84E-CF8240D57D2A",
                     versionEndExcluding: "5.2.5",
                     versionStartIncluding: "5.2.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0BAF02F2-6A4D-40D1-AFBB-F152327FECE7",
                     versionEndExcluding: "5.3.5",
                     versionStartIncluding: "5.3.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.",
      },
      {
         lang: "es",
         value: "En Hazelcast Platform hasta 5.3.4, existe un problema de seguridad dentro de la asignación SQL para el conector de origen de archivos CSV. Este problema surge de una verificación inadecuada de permisos, que podría permitir que clientes no autorizados accedan a datos de archivos almacenados en el sistema de archivos de un miembro.",
      },
   ],
   id: "CVE-2023-45860",
   lastModified: "2025-03-27T14:24:47.243",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            type: "Secondary",
         },
      ],
   },
   published: "2024-02-16T10:15:08.080",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
         ],
         url: "https://github.com/hazelcast/hazelcast/pull/25348",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://github.com/hazelcast/hazelcast/pull/25348",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2022-12-29 23:15
Modified
2024-11-21 07:13
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
References
cve@mitre.orghttps://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jpThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jpThird Party Advisory
Impacted products
Vendor Product Version
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast-jet *
hazelcast hazelcast-jet *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "9AD93A64-104B-4896-A576-F0BF8A9D8874",
                     versionEndExcluding: "3.12.13",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "3EB5EBCF-D752-4E18-B046-D35E4A72F567",
                     versionEndExcluding: "3.12.13",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "9CEE9CCA-A7A7-4607-A219-868977A66BE2",
                     versionEndExcluding: "4.1.10",
                     versionStartIncluding: "4.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "8274087A-7C77-4FF6-9D8A-1EC35EEBA79F",
                     versionEndExcluding: "4.1.10",
                     versionStartIncluding: "4.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "A0425943-B0F0-445E-9DE6-B178C923AD4F",
                     versionEndExcluding: "4.2.6",
                     versionStartIncluding: "4.2.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "80E43CED-EA47-42F7-A974-DF486138B0B0",
                     versionEndExcluding: "4.2.6",
                     versionStartIncluding: "4.2.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "B7D1B9D0-C466-41C4-8D69-09B4CB0A015A",
                     versionEndExcluding: "5.0.4",
                     versionStartIncluding: "5.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "6F49B2E6-5A58-4718-AB8F-C0C5A4E511C4",
                     versionEndExcluding: "5.0.4",
                     versionStartIncluding: "5.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "6525EDE4-68AE-403C-A3F4-C818E760A1A9",
                     versionEndExcluding: "5.1.3",
                     versionStartIncluding: "5.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "CF83CEDB-CF27-426C-B846-DB1596627D33",
                     versionEndExcluding: "5.1.3",
                     versionStartIncluding: "5.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast-jet:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "5ADD9F81-E40B-4BB8-9422-6ED2006043D2",
                     versionEndExcluding: "4.5.4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast-jet:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "FF545793-D052-4EFA-B74B-C6FC3DF12989",
                     versionEndExcluding: "4.5.4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.",
      },
      {
         lang: "es",
         value: "El controlador de conexión en Hazelcast y Hazelcast Jet permite que un atacante remoto no autenticado acceda y manipule datos en el clúster con la identidad de otra conexión ya autenticada. Las versiones de Hazelcast afectadas son la 4.0.6, 4.1.9, 4.2.5, 5.0.3 y 5.1.2. Las versiones de Hazelcast Jet afectadas son hasta la 4.5.3.",
      },
   ],
   id: "CVE-2022-36437",
   lastModified: "2024-11-21T07:13:00.420",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 9.1,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.2,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-12-29T23:15:09.883",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-384",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-07-18 16:15
Modified
2024-11-21 08:05
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
References
cve@mitre.orghttps://github.com/hazelcast/hazelcastProduct
cve@mitre.orghttps://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hazelcast/hazelcastProduct
af854a3a-2127-422b-91ae-364da2661108https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265Vendor Advisory
Impacted products
Vendor Product Version
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast hazelcast *
hazelcast imdg *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "B52A364A-BE21-465A-B718-B91AC9D81C18",
                     versionEndExcluding: "5.0.5",
                     versionStartIncluding: "5.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "A5593137-0500-4CE8-94FB-4EC65882D1D6",
                     versionEndExcluding: "5.0.5",
                     versionStartIncluding: "5.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "6A1AA694-39B1-46DA-86D2-217DEA432A9F",
                     versionEndExcluding: "5.1.7",
                     versionStartIncluding: "5.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "615BDF84-809F-4FD8-9B28-85016ADD0D6B",
                     versionEndExcluding: "5.1.7",
                     versionStartIncluding: "5.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "E5105B01-419F-4C4B-8EE7-6A872C76BB6B",
                     versionEndExcluding: "5.2.4",
                     versionStartIncluding: "5.2.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "B42460FE-CC73-45B9-86C6-D8E92FB23A49",
                     versionEndExcluding: "5.2.4",
                     versionStartIncluding: "5.2.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:hazelcast:imdg:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FA43F3F0-BE1D-4EFB-A6FE-92B93DE03CEE",
                     versionEndIncluding: "4.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.",
      },
   ],
   id: "CVE-2023-33265",
   lastModified: "2024-11-21T08:05:17.260",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-07-18T16:15:11.693",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Product",
         ],
         url: "https://github.com/hazelcast/hazelcast",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
         ],
         url: "https://github.com/hazelcast/hazelcast",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-862",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2019-05-22 14:29
Modified
2024-11-21 02:44
Severity ?
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
References
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2019:2413
cve@mitre.orghttps://github.com/hazelcast/hazelcast/issues/8024Issue Tracking, Third Party Advisory
cve@mitre.orghttps://github.com/hazelcast/hazelcast/pull/12230Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:2413
af854a3a-2127-422b-91ae-364da2661108https://github.com/hazelcast/hazelcast/issues/8024Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hazelcast/hazelcast/pull/12230Issue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
hazelcast hazelcast *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5D207CCB-8DD3-4DB8-87B9-7766D37E98E3",
                     versionEndExcluding: "3.11",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.",
      },
      {
         lang: "es",
         value: "En Hazelcast anterior de la versión 3.11, el procedimiento de apilado o agrupamiento es vulnerable a la ejecución remota de código por medio de la deserialización de Java. Si un atacante puede alcanzar una instancia de acceso a Hazelcast con un JoinRequest creado y existen clases vulnerables en el classpath, el atacante puede ejecutar un código arbitrario.",
      },
   ],
   id: "CVE-2016-10750",
   lastModified: "2024-11-21T02:44:39.580",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.8,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.2,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-05-22T14:29:00.223",
   references: [
      {
         source: "cve@mitre.org",
         url: "https://access.redhat.com/errata/RHSA-2019:2413",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/issues/8024",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/pull/12230",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2019:2413",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/issues/8024",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/hazelcast/hazelcast/pull/12230",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

cve-2022-36437
Vulnerability from cvelistv5
Published
2022-12-29 00:00
Modified
2024-08-03 10:07
Severity ?
Summary
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
References
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:07:33.982Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-29T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-36437",
      datePublished: "2022-12-29T00:00:00",
      dateReserved: "2022-07-25T00:00:00",
      dateUpdated: "2024-08-03T10:07:33.982Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-26168
Vulnerability from cvelistv5
Published
2020-11-09 21:28
Modified
2024-08-04 15:49
Severity ?
Summary
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.
References
https://docs.hazelcast.org/docs/ern/index.html#4-0-3x_refsource_MISC
https://jet-start.sh/blog/2020/10/23/jet-43-is-releasedx_refsource_MISC
https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypassx_refsource_CONFIRM
https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypassx_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:49:07.227Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://docs.hazelcast.org/docs/ern/index.html#4-0-3",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://jet-start.sh/blog/2020/10/23/jet-43-is-released",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2020-10-23T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-11-09T21:28:39",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://docs.hazelcast.org/docs/ern/index.html#4-0-3",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://jet-start.sh/blog/2020/10/23/jet-43-is-released",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2020-26168",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://docs.hazelcast.org/docs/ern/index.html#4-0-3",
                     refsource: "MISC",
                     url: "https://docs.hazelcast.org/docs/ern/index.html#4-0-3",
                  },
                  {
                     name: "https://jet-start.sh/blog/2020/10/23/jet-43-is-released",
                     refsource: "MISC",
                     url: "https://jet-start.sh/blog/2020/10/23/jet-43-is-released",
                  },
                  {
                     name: "https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass",
                     refsource: "CONFIRM",
                     url: "https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass",
                  },
                  {
                     name: "https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass",
                     refsource: "CONFIRM",
                     url: "https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2020-26168",
      datePublished: "2020-11-09T21:28:39",
      dateReserved: "2020-09-30T00:00:00",
      dateUpdated: "2024-08-04T15:49:07.227Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-33264
Vulnerability from cvelistv5
Published
2023-05-22 00:00
Modified
2025-01-21 15:20
Severity ?
Summary
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
References
https://github.com/hazelcast/hazelcast/pull/24266
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:39:36.071Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/hazelcast/hazelcast/pull/24266",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-33264",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-21T15:19:12.311118Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-21T15:20:07.435Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-05-22T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://github.com/hazelcast/hazelcast/pull/24266",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2023-33264",
      datePublished: "2023-05-22T00:00:00",
      dateReserved: "2023-05-22T00:00:00",
      dateUpdated: "2025-01-21T15:20:07.435Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-45860
Vulnerability from cvelistv5
Published
2024-02-16 00:00
Modified
2024-11-06 16:20
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.
References
https://github.com/hazelcast/hazelcast/pull/25348
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 6.5,
                     baseSeverity: "MEDIUM",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "NONE",
                     privilegesRequired: "LOW",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2023-45860",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-02-16T17:29:56.252913Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-89",
                        description: "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-06T16:20:00.171Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T20:29:32.470Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/hazelcast/hazelcast/pull/25348",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-02-16T09:18:22.041955",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://github.com/hazelcast/hazelcast/pull/25348",
            },
            {
               url: "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2023-45860",
      datePublished: "2024-02-16T00:00:00",
      dateReserved: "2023-10-14T00:00:00",
      dateUpdated: "2024-11-06T16:20:00.171Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-10750
Vulnerability from cvelistv5
Published
2019-05-22 13:40
Modified
2024-08-06 03:30
Severity ?
Summary
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
References
https://github.com/hazelcast/hazelcast/issues/8024x_refsource_MISC
https://github.com/hazelcast/hazelcast/pull/12230x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:2413vendor-advisory, x_refsource_REDHAT
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T03:30:20.142Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/hazelcast/hazelcast/issues/8024",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/hazelcast/hazelcast/pull/12230",
               },
               {
                  name: "RHSA-2019:2413",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2413",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-08-08T12:06:04",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/hazelcast/hazelcast/issues/8024",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/hazelcast/hazelcast/pull/12230",
            },
            {
               name: "RHSA-2019:2413",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2413",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-10750",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/hazelcast/hazelcast/issues/8024",
                     refsource: "MISC",
                     url: "https://github.com/hazelcast/hazelcast/issues/8024",
                  },
                  {
                     name: "https://github.com/hazelcast/hazelcast/pull/12230",
                     refsource: "MISC",
                     url: "https://github.com/hazelcast/hazelcast/pull/12230",
                  },
                  {
                     name: "RHSA-2019:2413",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:2413",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-10750",
      datePublished: "2019-05-22T13:40:06",
      dateReserved: "2019-05-22T00:00:00",
      dateUpdated: "2024-08-06T03:30:20.142Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-33265
Vulnerability from cvelistv5
Published
2023-07-18 00:00
Modified
2024-10-28 18:31
Severity ?
Summary
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
References
https://github.com/hazelcast/hazelcast
https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:39:36.082Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/hazelcast/hazelcast",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-33265",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-28T18:30:59.823350Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-28T18:31:09.582Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-18T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://github.com/hazelcast/hazelcast",
            },
            {
               url: "https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2023-33265",
      datePublished: "2023-07-18T00:00:00",
      dateReserved: "2023-05-22T00:00:00",
      dateUpdated: "2024-10-28T18:31:09.582Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0265
Vulnerability from cvelistv5
Published
2022-03-03 21:40
Modified
2024-08-02 23:25
Severity ?
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Summary
Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
References
https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563x_refsource_CONFIRM
https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748x_refsource_MISC
Impacted products
Vendor Product Version
hazelcast hazelcast/hazelcast Version: 5.1-BETA-1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:25:38.846Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "hazelcast/hazelcast",
               vendor: "hazelcast",
               versions: [
                  {
                     status: "affected",
                     version: "5.1-BETA-1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-611",
                     description: "CWE-611 Improper Restriction of XML External Entity Reference",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-08T09:15:46",
            orgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
            shortName: "@huntrdev",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748",
            },
         ],
         source: {
            advisory: "d63972a2-b910-480a-a86b-d1f75d24d563",
            discovery: "EXTERNAL",
         },
         title: "Improper Restriction of XML External Entity Reference in hazelcast/hazelcast",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@huntr.dev",
               ID: "CVE-2022-0265",
               STATE: "PUBLIC",
               TITLE: "Improper Restriction of XML External Entity Reference in hazelcast/hazelcast",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "hazelcast/hazelcast",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "=",
                                          version_value: "5.1-BETA-1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "hazelcast",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-611 Improper Restriction of XML External Entity Reference",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563",
                     refsource: "CONFIRM",
                     url: "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563",
                  },
                  {
                     name: "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748",
                     refsource: "MISC",
                     url: "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748",
                  },
               ],
            },
            source: {
               advisory: "d63972a2-b910-480a-a86b-d1f75d24d563",
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
      assignerShortName: "@huntrdev",
      cveId: "CVE-2022-0265",
      datePublished: "2022-03-03T21:40:10",
      dateReserved: "2022-01-17T00:00:00",
      dateUpdated: "2024-08-02T23:25:38.846Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}