CVE-2022-36437

2022-12-2923:15:09

CWE-384

[email protected]

web.nvd.nist.gov

remote access

unauthenticated

data manipulation

hazelcast

hazelcast jet

cve-2022-36437

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.002

Percentile

61.4%

JSON

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

Affected configurations

Nvd

Node

hazelcasthazelcastRange<3.12.13-

hazelcasthazelcastRange<3.12.13enterprise

hazelcasthazelcastRange4.0.0–4.1.10-

hazelcasthazelcastRange4.0.0–4.1.10enterprise

hazelcasthazelcastRange4.2.0–4.2.6-

hazelcasthazelcastRange4.2.0–4.2.6enterprise

hazelcasthazelcastRange5.0.0–5.0.4-

hazelcasthazelcastRange5.0.0–5.0.4enterprise

hazelcasthazelcastRange5.1.0–5.1.3-

hazelcasthazelcastRange5.1.0–5.1.3enterprise

hazelcasthazelcast-jetRange<4.5.4-

hazelcasthazelcast-jetRange<4.5.4enterprise

VendorProductVersionCPE
hazelcasthazelcast*cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:-:*:*:*
hazelcasthazelcast*cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*
hazelcasthazelcast-jet*cpe:2.3:a:hazelcast:hazelcast-jet:*:*:*:*:-:*:*:*
hazelcasthazelcast-jet*cpe:2.3:a:hazelcast:hazelcast-jet:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
hazelcast	hazelcast	*	cpe:2.3:a:hazelcast:hazelcast:::::-:::*
hazelcast	hazelcast	*	cpe:2.3:a:hazelcast:hazelcast:::::enterprise:::*
hazelcast	hazelcast-jet	*	cpe:2.3:a:hazelcast:hazelcast-jet:::::-:::*
hazelcast	hazelcast-jet	*	cpe:2.3:a:hazelcast:hazelcast-jet:::::enterprise:::*