Sensitive Information Disclosure

2023-05-2407:43:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

hazelcast

information disclosure

configxmlgenerator

password

vulnerability

0.0005 Low

EPSS

Percentile

17.7%

JSON

Hazelcast is vulnerable to Information Disclosure. The vulnerability exists in the getOrMaskValue function at ConfigXmlGenerator.java because the password is not properly masked which allows an attacker to view sensitive information such as the password.

CPENameOperatorVersion
hazelcastle5.3.0-BETA-2
hazelcastle5.3.0-BETA-2

CPE	Name	Operator	Version
	hazelcast	le	5.3.0-BETA-2
	hazelcast	le	5.3.0-BETA-2

References

github.com/advisories/GHSA-5gj6-62g7-vmgf

github.com/hazelcast/hazelcast/commit/74eed86c2b2b727148c442e98a01d0ca6941a49e

github.com/hazelcast/hazelcast/pull/24266

0.0005 Low

EPSS

Percentile

17.7%

JSON

Related for VERACODE:40666