Hazelcast vulnerable to unmasked password exposure
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-33264US | medium4.3 | — | ||
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Manage… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/hazelcast/hazelcastPACKAGE
- https://github.com/hazelcast/hazelcast/commit/74eed86c2b2b727148c442e98a01d0ca6941a49eWEB
- https://github.com/hazelcast/hazelcast/pull/24266WEB
- https://github.com/hazelcast/hazelcast/pull/24266/commits/80a502d53cc48bf895711ab55f95e3a51e344ac1WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-33264ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan