Critical severity · published Dec 29, 2022
CVE-2022-36437
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already…
9.1
CVSS
1.1%
EPSS
No
On KEV
Description
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Hazelcast · Hazelcast
before 3.12.13; before 3.12.13; 4.0.0 before 4.1.10; 4.0.0 before 4.1.10; 4.2.0 before 4.2.6; 4.2.0 before 4.2.6; +4 more · source: NVD
HA
Hazelcast-jet · Hazelcast
before 4.5.4; before 4.5.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-36437
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-36437
Third Party Advisory
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp
More from Hazelcast
9.8
CVE-2022-0265
Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
9.8
CVE-2020-26168
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some…
9.3
CVE-2026-107726
Hazelcast: Arbitrary member memory access by low-privileged client
8.8
CVE-2023-33265
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on…
8.7
CVE-2026-107725
Hazelcast: Authorization bypass in IMap Predicates API