CVE-2023-45860 Security Details

CVE ID

CVE-2023-45860

CWE

CWE-89

CVE Description

In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.

Published

Oct 17, 2023

CVSS Score & Severity

6.5Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

0.459%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/hazelcast/jet/impl/connector/ReadFilesP$MetaSupplier.get(Ljava/util/List;)Ljava/util/function/Function;

JVMVulnerable params: 0

com/hazelcast/jet/impl/connector/ReadFilesP.<init>(Ljava/lang/String;Ljava/lang/String;ZZLcom/hazelcast/function/FunctionEx;Lcom/hazelcast/jet/impl/connector/ReadFilesP$1;)V

JVMVulnerable params: 0

com/hazelcast/jet/sql/impl/JetPlanExecutor.execute(Lcom/hazelcast/jet/sql/impl/JetPlan$CreateMappingPlan;)Lcom/hazelcast/sql/SqlResult;

JVMVulnerable params: 0

com/hazelcast/jet/sql/impl/PlanExecutor.execute(Lcom/hazelcast/jet/sql/impl/SqlPlanImpl$CreateMappingPlan;)Lcom/hazelcast/sql/SqlResult;

JVMVulnerable params: 0

com/hazelcast/jet/sql/impl/PlanExecutor.execute(Lcom/hazelcast/jet/sql/impl/SqlPlanImpl$IMapSelectPlan;Lcom/hazelcast/sql/impl/QueryId;Ljava/util/List;J)Lcom/hazelcast/sql/SqlResult;

JVMVulnerable params: 0

com/hazelcast/sql/impl/SqlServiceImpl.query0(Lcom/hazelcast/sql/impl/QueryId;Ljava/lang/String;Ljava/lang/String;Ljava/util/List;JILcom/hazelcast/sql/SqlExpectedResultType;Lcom/hazelcast/sql/impl/security/SqlSecurityContext;)Lcom/hazelcast/sql/SqlResult;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · PR #25661PROJECT

GitHub · PR #860PROJECT