GHSA-c5vj-wp4v-mmvx

Suggest an improvement
Source
https://github.com/advisories/GHSA-c5vj-wp4v-mmvx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-c5vj-wp4v-mmvx/GHSA-c5vj-wp4v-mmvx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c5vj-wp4v-mmvx
Aliases
Published
2023-07-19T22:08:40Z
Modified
2024-02-16T08:10:07Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
Hazelcast Executor Services don't check client permissions properly
Details

Impact

In Hazelcast Platform, 5.0 through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, and Hazelcast IMDG (all versions up to 4.2.z), Executor Services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.

Patches

Fix versions: 5.3.0, 5.2.4, 5.1.7, 5.0.5

Workarounds

Users are only affected when they already use executor services (i.e., an instance exists as a distributed data structure).

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-19T22:08:40Z",
    "nvd_published_at": "2023-07-18T16:15:11Z",
    "severity": "HIGH"
}
References

Affected packages

Maven
com.hazelcast:hazelcast

Package

Name
com.hazelcast:hazelcast
View open source insights on deps.dev
Purl
pkg:maven/com.hazelcast/hazelcast

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
5.2.4

Affected versions

5.*
5.2.0
5.2.1
5.2.2
5.2.3

Database specific

last_known_affected_version_range 
"<= 5.2.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-c5vj-wp4v-mmvx/GHSA-c5vj-wp4v-mmvx.json"
com.hazelcast:hazelcast

Package

Name
com.hazelcast:hazelcast
View open source insights on deps.dev
Purl
pkg:maven/com.hazelcast/hazelcast

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
5.1.7

Affected versions

5.*
5.1
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6

Database specific

last_known_affected_version_range 
"<= 5.1.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-c5vj-wp4v-mmvx/GHSA-c5vj-wp4v-mmvx.json"
com.hazelcast:hazelcast

Package

Name
com.hazelcast:hazelcast
View open source insights on deps.dev
Purl
pkg:maven/com.hazelcast/hazelcast

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.0.5

Affected versions

1.*
1.5
1.5.1
1.5.2
1.5.3
1.6-RC1
1.6
1.7-RC1
1.7-RC2
1.7-RC3
1.7-RC4
1.7
1.7.1
1.8
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.9
1.9.1-RC2
1.9.1
1.9.2
1.9.2.1
1.9.2.2
1.9.2.3
1.9.3-RC
1.9.3
1.9.3.1
1.9.3.2
1.9.3.3
1.9.3.4
1.9.4-RC
1.9.4-RC1
1.9.4
1.9.4.1
1.9.4.2
1.9.4.3
1.9.4.4
1.9.4.5
1.9.4.6
1.9.4.8
2.*
2.0-RC1
2.0-RC2
2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1
2.1.1
2.1.2
2.1.3
2.2
2.3
2.3.1
2.4
2.4.1
2.5
2.5.1
2.6
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.6.10
3.*
3.0-RC1
3.0-RC2
3.0
3.0.1
3.0.2
3.0.3
3.1
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2-RC1
3.2-RC2
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.3-RC1
3.3-RC2
3.3-RC3
3.3
3.3-EA
3.3-EA2
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.4
3.4-EA
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8
3.5
3.5-EA
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.6-RC1
3.6
3.6-EA
3.6-EA2
3.6-EA3
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.7
3.7-EA
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.7.6
3.7.7
3.7.8
3.8-RC1
3.8
3.8-EA
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.8.8
3.8.9
3.9
3.9-EA
3.9.1
3.9.2
3.9.3
3.9.4
3.10-BETA-1
3.10-BETA-2
3.10
3.10.1
3.10.2
3.10.3
3.10.4
3.10.5
3.10.6
3.10.7
3.11-BETA-1
3.11
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.12-BETA-1
3.12-BETA-2
3.12
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.12.10
3.12.11
3.12.12
3.12.13
4.*
4.0-BETA-1
4.0-BETA-2
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.1-BETA-1
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1.10
4.2-BETA-1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
5.*
5.0-BETA-1
5.0-BETA-2
5.0
5.0.1
5.0.2
5.0.3
5.0.4

Database specific

last_known_affected_version_range 
"<= 5.0.4"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-c5vj-wp4v-mmvx/GHSA-c5vj-wp4v-mmvx.json"
com.hazelcast:hazelcast-enterprise

Package

Name
com.hazelcast:hazelcast-enterprise
View open source insights on deps.dev
Purl
pkg:maven/com.hazelcast/hazelcast-enterprise

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
5.2.4

Database specific

last_known_affected_version_range 
"<= 5.2.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-c5vj-wp4v-mmvx/GHSA-c5vj-wp4v-mmvx.json"
com.hazelcast:hazelcast-enterprise

Package

Name
com.hazelcast:hazelcast-enterprise
View open source insights on deps.dev
Purl
pkg:maven/com.hazelcast/hazelcast-enterprise

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
5.1.7

Database specific

last_known_affected_version_range 
"<= 5.1.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-c5vj-wp4v-mmvx/GHSA-c5vj-wp4v-mmvx.json"
com.hazelcast:hazelcast-enterprise

Package

Name
com.hazelcast:hazelcast-enterprise
View open source insights on deps.dev
Purl
pkg:maven/com.hazelcast/hazelcast-enterprise

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.0.5

Database specific

last_known_affected_version_range 
"<= 5.0.4"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-c5vj-wp4v-mmvx/GHSA-c5vj-wp4v-mmvx.json"