In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for…
Priority LOW 30CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.
Summary
In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00544 45th percentileScored 2026-11-07
Fix Partial com.hazelcast:hazelcast (Maven): 5.3.5, 5.2.5com.hazelcast:hazelcast-enterprise (Maven): 5.3.5, 5.2.5Red Hat: 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.hazelcast:hazelcast (Maven) | 5.3.0 to before 5.3.5 | 5.3.5 | Patch available | GHSA-8h4x-xvjp-vf99 |
| — | com.hazelcast:hazelcast-enterprise (Maven) | 5.3.0 to before 5.3.5 | 5.3.5 | Patch available | GHSA-8h4x-xvjp-vf99 |
| — | com.hazelcast:hazelcast-enterprise (Maven) | 5.2.0 to before 5.2.5 | 5.2.5 | Patch available | GHSA-8h4x-xvjp-vf99 |
| — | com.hazelcast:hazelcast-enterprise (Maven) | up to 5.1.7 | — | No fix listed | GHSA-8h4x-xvjp-vf99 |
| — | com.hazelcast:hazelcast (Maven) | 5.2.0 to before 5.2.5 | 5.2.5 | Patch available | GHSA-8h4x-xvjp-vf99 |
| — | com.hazelcast:hazelcast (Maven) | up to 5.1.7 | — | No fix listed | GHSA-8h4x-xvjp-vf99 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.hazelcast:hazelcast (Maven) Vendor— Affected 5.3.0 to before 5.3.5 Fixed in 5.3.5 Patch available GHSA-8h4x-xvjp-vf99
- com.hazelcast:hazelcast-enterprise (Maven) Vendor— Affected 5.3.0 to before 5.3.5 Fixed in 5.3.5 Patch available GHSA-8h4x-xvjp-vf99
- com.hazelcast:hazelcast-enterprise (Maven) Vendor— Affected 5.2.0 to before 5.2.5 Fixed in 5.2.5 Patch available GHSA-8h4x-xvjp-vf99
- com.hazelcast:hazelcast-enterprise (Maven) Vendor— Affected up to 5.1.7 Fixed in — No fix listed GHSA-8h4x-xvjp-vf99
- com.hazelcast:hazelcast (Maven) Vendor— Affected 5.2.0 to before 5.2.5 Fixed in 5.2.5 Patch available GHSA-8h4x-xvjp-vf99
- com.hazelcast:hazelcast (Maven) Vendor— Affected up to 5.1.7 Fixed in — No fix listed GHSA-8h4x-xvjp-vf99
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:* | up to 5.1.7; 5.2.0 to before 5.2.5; 5.3.0 to before 5.3.5 | Vulnerable | hazelcast |
- cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:*:*:*:* Versions up to 5.1.7; 5.2.0 to before 5.2.5; 5.3.0 to before 5.3.5 Vulnerable ·hazelcast
Remediation
- Fix · GHSA-8h4x-xvjp-vf99 com.hazelcast:hazelcast (Maven) Fixed in 5.3.5 Advisory →
- Fix · GHSA-8h4x-xvjp-vf99 com.hazelcast:hazelcast-enterprise (Maven) Fixed in 5.3.5 Advisory →
- Fix · GHSA-8h4x-xvjp-vf99 com.hazelcast:hazelcast-enterprise (Maven) Fixed in 5.2.5 Advisory →
- Fix · GHSA-8h4x-xvjp-vf99 com.hazelcast:hazelcast (Maven) Fixed in 5.2.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Out of support scope |
| streams for Apache Kafka | Affected | No fix planned: Will not fix |
Not affected: 5 products
- Red Hat Data Grid 8
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45860
- 2026-10-03 Alias added: GHSA-8h4x-xvjp-vf99
References
Advisory 2
More Hazelcast vulnerabilities
- TI-2022-16762 The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated… CVSS 3.1CRITICAL 9.1
- TI-2022-00199 Improper Restriction of XML External Entity Reference in hazelcast/hazelcast CVSS 3.1CRITICAL 9.8
- TI-2020-16001 The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before… CVSS 3.1CRITICAL 9.8
- TI-2016-08788 In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code… CVSS 3.0HIGH 8.1
- TI-2023-16430 In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services… CVSS 3.1HIGH 8.8
- TI-2023-24616 In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2… CVSS 3.1HIGH 7.6
Sources
- CVE-2023-45860 · CVE Program
- CVE-2023-45860 · NVD
- FIRST EPSS
- GHSA-8h4x-xvjp-vf99 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-45860 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences