GitHub Advisoryadvisory · Maven

GHSA-5gj6-62g7-vmgf Hazelcast vulnerable to unmasked password exposure

MEDIUM Published 2023-05-22 Modified 2025-10-02 Official page ↗
Aliases
CVE-2023-33264
Ecosystem
Maven
Packages
com.hazelcast:hazelcast
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-522
Reviewed
2023-05-22

Affected packages

• Maven com.hazelcast:hazelcast: >= 4.0-BETA-1, <= 4.2.8 (no fix yet) • Maven com.hazelcast:hazelcast: >= 5.0-BETA-1, < 5.0.5 → fixed in 5.0.5 • Maven com.hazelcast:hazelcast: >= 5.1-BETA-1, < 5.1.6 → fixed in 5.1.6 • Maven com.hazelcast:hazelcast: >= 5.2-BETA-1, < 5.2.4 → fixed in 5.2.4 • Maven com.hazelcast:hazelcast: >= 5.3.0-BETA-1, < 5.3.0 → fixed in 5.3.0

Description

In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.

Related

Alias · CVE (1)

  • CVE-2023-33264 In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References