In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations dont check permissions properly, allowing authenticated users to access data stored in the cluster.
Weakness
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hazelcast | Hazelcast | * | 4.1.10 (including) |
| Hazelcast | Hazelcast | 4.2.0 (including) | 4.2.8 (including) |
| Hazelcast | Hazelcast | 5.0.0 (including) | 5.0.5 (including) |
| Hazelcast | Hazelcast | 5.1.0 (including) | 5.1.7 (including) |
| Hazelcast | Hazelcast | 5.2.0 (including) | 5.2.5 (excluding) |
| Hazelcast | Hazelcast | 5.3.0 (including) | 5.3.5 (excluding) |