by Kastro
Paper/Archive/CVE-2022-36437

CVE-2022-36437

mitre — The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the clust…

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD, ADP agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 65.3.653 × 2013.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp