CVE-2023-45860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-45860
In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/hazelcast/hazelcast/pull/25348 Patch
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99 Vendor Advisory
https://github.com/hazelcast/hazelcast/pull/25348 Patch
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*
History

27 Mar 2025, 14:24

Type Values Removed Values Added
First Time Hazelcast hazelcast
Hazelcast
References () https://github.com/hazelcast/hazelcast/pull/25348 - () https://github.com/hazelcast/hazelcast/pull/25348 - Patch
References () https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99 - () https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99 - Vendor Advisory
CPE cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:*

21 Nov 2024, 08:27

Type Values Removed Values Added
References () https://github.com/hazelcast/hazelcast/pull/25348 - () https://github.com/hazelcast/hazelcast/pull/25348 -
References () https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99 - () https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99 -

06 Nov 2024, 17:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-89

16 Feb 2024, 13:37

Type Values Removed Values Added
Summary
  • (es) En Hazelcast Platform hasta 5.3.4, existe un problema de seguridad dentro de la asignación SQL para el conector de origen de archivos CSV. Este problema surge de una verificación inadecuada de permisos, que podría permitir que clientes no autorizados accedan a datos de archivos almacenados en el sistema de archivos de un miembro.

16 Feb 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-16 10:15

Updated : 2025-03-27 14:24

NVD link : CVE-2023-45860

Mitre link : CVE-2023-45860

CVE.ORG link : CVE-2023-45860

JSON object : View

Products Affected

hazelcast

  • hazelcast
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')