GHSA-xh6m-7cr7-xx66 Missing permission checks on Hazelcast client protocol

• Maven com.hazelcast:hazelcast: <= 4.1.10 (no fix yet) • Maven com.hazelcast:hazelcast: >= 4.2, <= 4.2.8 (no fix yet) • Maven com.hazelcast:hazelcast: >= 5.0, <= 5.0.5 (no fix yet) • Maven com.hazelcast:hazelcast: >= 5.1, <= 5.1.7 (no fix yet) • Maven com.hazelcast:hazelcast: >= 5.2.0, < 5.2.5 → fixed in 5.2.5 • Maven com.hazelcast:hazelcast: >= 5.3.0, < 5.3.5 → fixed in 5.3.5 • Maven com.hazelcast:hazelcast-all: <= 4.1.10 (no fix yet) • Maven com.hazelcast:hazelcast-all: >= 4.2, <= 4.2.8 (no fix yet)

Impact In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster. Patches Fix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1 Workarounds There is no known workaround.