7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-33265

GHSA ID

GHSA-c5vj-wp4v-mmvx

EPSS Score

0.39123%

CWE

CWE-862

Published

7/19/2023

Updated

11/7/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-33265

CVE-2023-33265: Hazelcast Executor Services don't check client permissions properly

Impact

In Hazelcast Platform, 5.0 through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, and Hazelcast IMDG (all versions up to 4.2.z), Executor Services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.

Patches

Fix versions: 5.3.0, 5.2.4, 5.1.7, 5.0.5

Workarounds

Users are only affected when they already use executor services (i.e., an instance exists as a distributed data structure).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-33265

CVE-2023-33265:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-33265

GHSA ID

GHSA-c5vj-wp4v-mmvx

EPSS Score

0.39123%

CWE

CWE-862

Published

7/19/2023

Updated

11/7/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.hazelcast:hazelcast	maven	>= 5.2.0, <= 5.2.3	5.2.4
com.hazelcast:hazelcast	maven	>= 5.1.0, <= 5.1.6	5.1.7
com.hazelcast:hazelcast	maven	<= 5.0.4	5.0.5
com.hazelcast:hazelcast-enterprise	maven	>= 5.2.0, <= 5.2.3	5.2.4
com.hazelcast:hazelcast-enterprise	maven	>= 5.1.0, <= 5.1.6	5.1.7
com.hazelcast:hazelcast-enterprise	maven	<= 5.0.4	5.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-33265: Hazelcast Executor Services don't check client permissions properly

Impact

Patches

Workarounds

CVE-2023-33265:

7.6

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

CVE-2023-33265: Hazelcast Executor Services don't check client permissions properly

Impact

Patches

Workarounds

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

7.6

7.6

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI