Insecure File Access in Hazelcast Platform through 5.3.4
CVE-2023-45860

6.5MEDIUM

Key Information:

Vendor

Hazelcast

Status
Hazelcast
Vendor
CVE Published:
16 February 2024

What is CVE-2023-45860?

In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.

References

https://github.com/hazelcast/hazelcast/pull/25348
https://github.com/hazelcast/hazelcast/security/advisorie...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.