PT-2025-17196 · Hazelcast · Hazelcast Management Center

Published 2025-04-17 · Updated 2025-04-17 · CVE-2024-56518

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hazelcast Management Center versions prior to 6.0

Description The issue allows remote code execution through a JndiLoginModule user.provider.url in a hazelcast-client XML document, which can be uploaded at the "/cluster-connections" API endpoint.

Recommendations For versions prior to 6.0, consider disabling the ability to upload hazelcast-client XML documents at the "/cluster-connections" API endpoint until a patch is available. Restrict access to the JndiLoginModule to minimize the risk of exploitation. Avoid using the user.provider.url variable in the affected API endpoint until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-56518

Affected Products

Hazelcast Management Center

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-56518 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56518 · Vendor Advisory
• https://gist.github.com/azraelxuemo/c3d42739aa3306a41111ef603dc65b4c · Note
• https://docs.hazelcast.com/management-center/6.0-snapshot/getting-started/install · Note