PT-2023-7546 · Hazelcast · Hazelcast

Published 2023-05-21 · Updated 2023-06-02 · CVE-2023-33264

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hazelcast versions 5.0.0 through 5.0.4 Hazelcast versions 5.1.0 through 5.1.6 Hazelcast versions 5.2.0 through 5.2.3

Description The issue is related to insufficient protection of registration data in the Hazelcast platform, which can be exploited by a remote attacker to disclose protected information. Specifically, configuration routines do not mask passwords in the member configuration properly, allowing Hazelcast Management Center users to view some secrets.

Recommendations For Hazelcast versions 5.0.0 through 5.0.4, update to a version later than 5.0.4 to fix the issue. For Hazelcast versions 5.1.0 through 5.1.6, update to a version later than 5.1.6 to fix the issue. For Hazelcast versions 5.2.0 through 5.2.3, update to a version later than 5.2.3 to fix the issue. As a temporary workaround, consider restricting access to the Hazelcast Management Center to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-522

CWE-200

Related Identifiers

BDU:2023-08601

CVE-2023-33264

GHSA-5GJ6-62G7-VMGF

Affected Products

Hazelcast

References · 9

• https://github.com/hazelcast/hazelcast/pull/24266 · Patch
• https://osv.dev/vulnerability/GHSA-5gj6-62g7-vmgf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08601 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-33264 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33264 · Vendor Advisory
• https://github.com/hazelcast/hazelcast · Note
• https://github.com/hazelcast/hazelcast/commit/74eed86c2b2b727148c442e98a01d0ca6941a49e · Note
• https://github.com/hazelcast/hazelcast/pull/24266/commits/80a502d53cc48bf895711ab55f95e3a51e344ac1 · Note
• https://t.me/cvenotify/50882 · Telegram Post