high7.6
CVE-2023-45859
Missing permission checks on Hazelcast client protocol
Impact
### Impact In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster. ### Patches Fix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1 ### Workarounds There is no known workaround.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.hazelcast:hazelcast | <= 4.1.10 | none recorded |
| maven | com.hazelcast:hazelcast-all | <= 4.1.10 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hazelcast | Hazelcast | through 4.1.10 from 4.2.0 through 4.2.8 from 5.0.0 through 5.0.5 from 5.1.0 through 5.1.7 from 5.2.0 before 5.2.5 from 5.3.0 before 5.3.5 |