CVE-2023-33265
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In Hazelcast versions 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services do not properly check client permissions, allowing authenticated users to execute tasks on members without the required permissions.
Risk Assessment
The organization may be exposed to unauthorized task execution by users, potentially compromising system and data integrity.
Recommendation
It is recommended to upgrade to the latest version of Hazelcast where user permission checks have been fixed.
Other vulnerabilities in Hazelcast
Original NVD description (English source)
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS