High severity · published Jul 18, 2023
CVE-2023-33265
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on…
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Hazelcast · Hazelcast
5.0.0 before 5.0.5; 5.0.0 before 5.0.5; 5.1.0 before 5.1.7; 5.1.0 before 5.1.7; 5.2.0 before 5.2.4; 5.2.0 before 5.2.4 · source: NVD
IM
Imdg · Hazelcast
through 4.2.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33265
Product
https://github.com/hazelcast/hazelcast
Vendor Advisory
https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265
More from Hazelcast
9.8
CVE-2022-0265
Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
9.8
CVE-2020-26168
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some…
9.3
CVE-2026-107726
Hazelcast: Arbitrary member memory access by low-privileged client
9.1
CVE-2022-36437
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already…
8.7
CVE-2026-107725
Hazelcast: Authorization bypass in IMap Predicates API