Hazelcast vulnerable to unmasked password exposure

GHSA-5gj6-62g7-vmgf · CVE-2023-33264

Published May 22, 2023 · Modified Oct 2, 2025

Description

In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-33264
WEB https://github.com/hazelcast/hazelcast/pull/24266
WEB https://github.com/hazelcast/hazelcast/pull/24266/commits/80a502d53cc48bf895711ab55f95e3a51e344ac1
WEB https://github.com/hazelcast/hazelcast/commit/74eed86c2b2b727148c442e98a01d0ca6941a49e
PACKAGE https://github.com/hazelcast/hazelcast

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes