GHSA-xh6m-7cr7-xx66
Missing permission checks on Hazelcast client protocol
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.hazelcast:hazelcast | <= 4.1.10 | no fix listed |
| Maven | com.hazelcast:hazelcast | >= 4.2, <= 4.2.8 | no fix listed |
| Maven | com.hazelcast:hazelcast | >= 5.0, <= 5.0.5 | no fix listed |
| Maven | com.hazelcast:hazelcast | >= 5.1, <= 5.1.7 | no fix listed |
| Maven | com.hazelcast:hazelcast | >= 5.2.0, < 5.2.5 | 5.2.5 |
| Maven | com.hazelcast:hazelcast | >= 5.3.0, < 5.3.5 | 5.3.5 |
| Maven | com.hazelcast:hazelcast-all | <= 4.1.10 | no fix listed |
| Maven | com.hazelcast:hazelcast-all | >= 4.2, <= 4.2.8 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
### Patches
Fix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1
### Workarounds
There is no known workaround.
References
External links from the advisory. They lead to third-party sites.