GHSA-C5VJ-WP4V-MMVX
Vulnerability from github – Published: 2023-07-19 22:08 – Updated: 2023-07-19 22:08
VLAI?
Summary
Hazelcast Executor Services don't check client permissions properly
Details
Impact
In Hazelcast Platform, 5.0 through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, and Hazelcast IMDG (all versions up to 4.2.z), Executor Services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
Patches
Fix versions: 5.3.0, 5.2.4, 5.1.7, 5.0.5
Workarounds
Users are only affected when they already use executor services (i.e., an instance exists as a distributed data structure).
Severity ?
7.6 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.2.3"
},
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.1.6"
},
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.1.0"
},
{
"fixed": "5.1.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.0.4"
},
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.2.3"
},
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast-enterprise"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.1.6"
},
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast-enterprise"
},
"ranges": [
{
"events": [
{
"introduced": "5.1.0"
},
{
"fixed": "5.1.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.0.4"
},
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast-enterprise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-33265"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-19T22:08:40Z",
"nvd_published_at": "2023-07-18T16:15:11Z",
"severity": "HIGH"
},
"details": "### Impact\nIn Hazelcast Platform, 5.0 through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, and Hazelcast IMDG (all versions up to 4.2.z), Executor Services don\u0027t check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.\n\n### Patches\nFix versions: 5.3.0, 5.2.4, 5.1.7, 5.0.5\n\n### Workarounds\nUsers are only affected when they already use executor services (i.e., an instance exists as a distributed data structure).\n\n",
"id": "GHSA-c5vj-wp4v-mmvx",
"modified": "2023-07-19T22:08:40Z",
"published": "2023-07-19T22:08:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5vj-wp4v-mmvx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33265"
},
{
"type": "PACKAGE",
"url": "https://github.com/hazelcast/hazelcast"
},
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/releases/tag/v5.0.5"
},
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/releases/tag/v5.1.7"
},
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/releases/tag/v5.2.4"
},
{
"type": "WEB",
"url": "https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Hazelcast Executor Services don\u0027t check client permissions properly"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…