CVE-2023-33264
Hazelcast vulnerable to unmasked password exposure
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
CVE-2023-33264- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
CVE List No score
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
CVE-2023-33264- Updated
- 2026-11-02
EUVDEUVD-2023-1474 No score
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
EUVD-2023-1474- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gj6-62g7-vmgf
Hazelcast vulnerable to unmasked password exposure
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
GHSA-5gj6-62g7-vmgf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-522
- Updated
- 2026-11-02
OSVGHSA-5gj6-62g7-vmgf
Hazelcast vulnerable to unmasked password exposure
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
GHSA-5gj6-62g7-vmgf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-522
- Updated
- 2026-11-02
OSVCLSA-2026-1769990937 No score
TuxCare security update for com.hazelcast (3 CVEs)
TuxCare rebuilt 2 com.hazelcast packages to address 3 CVEs. Fixed in 4.2.8-tuxcare.1.
- Record
CLSA-2026-1769990937- Updated
- 2026-11-02
OSV No score
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
CVE-2023-33264- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.hazelcast:hazelcastMaven |
4.0-BETA-1 to 4.2.8 | None known |
com.hazelcast:hazelcastMaven |
5.0-BETA-1 up to 5.0.5 | 5.0.5 |
com.hazelcast:hazelcastMaven |
5.1-BETA-1 up to 5.1.6 | 5.1.6 |
com.hazelcast:hazelcastMaven |
5.2-BETA-1 up to 5.2.4 | 5.2.4 |
com.hazelcast:hazelcastMaven |
5.3.0-BETA-1 up to 5.3.0 | 5.3.0 |
com.hazelcast:hazelcastTuxCare:Maven From an advisory covering 3 CVEs |
4.2.8 up to 4.2.8-tuxcare.1 | 4.2.8-tuxcare.1 |
com.hazelcast:hazelcast-allTuxCare:Maven From an advisory covering 3 CVEs |
4.2.8 up to 4.2.8-tuxcare.1 | 4.2.8-tuxcare.1 |
com.hazelcast:hazelcastMaven |
4.0-BETA-1 to 4.2.8, plus listed versions 4.04.0-BETA-24.0.14.0.24.0.3 Show 24 moreShow less4.0.44.0.54.0.64.14.1-BETA-14.1.14.1.104.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.24.2-BETA-14.2.14.2.24.2.34.2.44.2.54.2.64.2.7 |
None known |
com.hazelcast:hazelcastMaven |
5.0-BETA-1 up to 5.0.5, plus listed versions 5.05.0-BETA-25.0.15.0.25.0.35.0.4 |
5.0.5 |
com.hazelcast:hazelcastMaven |
5.1-BETA-1 up to 5.1.6, plus listed versions 5.15.1.15.1.25.1.35.1.45.1.5 |
5.1.6 |
com.hazelcast:hazelcastMaven |
5.2-BETA-1 up to 5.2.4, plus listed versions 5.2.05.2.15.2.25.2.3 |
5.2.4 |
com.hazelcast:hazelcastMaven |
5.3.0-BETA-1 up to 5.3.0, plus listed versions 5.3.0-BETA-2 |
5.3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-33264 is a medium vulnerability (CVSS 4.3) in Hazelcast, published May 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in com.hazelcast:hazelcast 5.0.5.
References
github.com/hazelcast/hazelcast/pull/24266
nvd.nist.gov/vuln/detail/CVE-2023-33264