medium4.3
CVE-2023-33264
Hazelcast vulnerable to unmasked password exposure
Impact
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.hazelcast:hazelcast | >= 4.0-BETA-1, <= 4.2.8 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hazelcast | Hazelcast | through 5.0.4 from 5.1 before 5.1.6 from 5.2 through 5.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/hazelcast/hazelcast/pull/24266
- https://github.com/advisories/GHSA-5gj6-62g7-vmgf
- https://nvd.nist.gov/vuln/detail/CVE-2023-33264
- https://github.com/hazelcast/hazelcast/pull/24266/commits/80a502d53cc48bf895711ab55f95e3a51e344ac1
- https://github.com/hazelcast/hazelcast/commit/74eed86c2b2b727148c442e98a01d0ca6941a49e