VulnerabilityAnalyzed

CVE-2023-45860

This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.

MEDIUM 6.5EPSS 0.54%

Does this matter?

Lower severity and a low EPSS score (0.54%). Track it; it rarely justifies an emergency change on its own.

Description

In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.54% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: hazelcast/hazelcast
Source: cve@mitre.org

References

https://github.com/hazelcast/hazelcast/pull/25348Patch
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99Vendor Advisory
https://github.com/hazelcast/hazelcast/pull/25348Patch
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.