Insufficient Permission Checks in Hazelcast Clusters

CVE-2023-45859

What is CVE-2023-45859?

A significant vulnerability in multiple versions of Hazelcast allows certain client operations to bypass permission checks, thus enabling authenticated users to access sensitive data within the cluster. The flaw is prevalent across a range of versions, including 4.1.10, 4.2 through 4.2.8, and 5.0 through 5.3.2. This oversight poses risks for data integrity and confidentiality, highlighting the necessity for users to review their security configurations and apply the latest patches to safeguard their systems. The detailed documentation and advisories can be found in the official GitHub resources.

References