CVE-2023-33264
Hazelcast vulnerable to unmasked password exposure
CVE-2023-33264 is a medium vulnerability (CVSS 4.3) in Hazelcast, published May 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in com.hazelcast:hazelcast 5.0.5.
- Severity
- 4.3 MediumCVSS 3.1, NVD
- Exploit chance
- 0.72%EPSS, 54th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.0.5com.hazelcast:hazelcast +11 more
Description
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.hazelcast:hazelcastMaven | 4.0-BETA-1 to 4.2.8 | None known |
com.hazelcast:hazelcastMaven | 5.0-BETA-1 up to 5.0.5 | 5.0.5 |
com.hazelcast:hazelcastMaven | 5.1-BETA-1 up to 5.1.6 | 5.1.6 |
com.hazelcast:hazelcastMaven | 5.2-BETA-1 up to 5.2.4 | 5.2.4 |
com.hazelcast:hazelcastMaven | 5.3.0-BETA-1 up to 5.3.0 | 5.3.0 |
com.hazelcast:hazelcastTuxCare:Maven From an advisory covering 3 CVEs | 4.2.8 up to 4.2.8-tuxcare.1 | 4.2.8-tuxcare.1 |
com.hazelcast:hazelcast-allTuxCare:Maven From an advisory covering 3 CVEs | 4.2.8 up to 4.2.8-tuxcare.1 | 4.2.8-tuxcare.1 |
com.hazelcast:hazelcastMaven | 4.0-BETA-1 to 4.2.8, plus listed versions 4.04.0-BETA-24.0.14.0.24.0.3 Show 24 moreShow less4.0.44.0.54.0.64.14.1-BETA-14.1.14.1.104.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.24.2-BETA-14.2.14.2.24.2.34.2.44.2.54.2.64.2.7 | None known |
com.hazelcast:hazelcastMaven | 5.0-BETA-1 up to 5.0.5, plus listed versions 5.05.0-BETA-25.0.15.0.25.0.35.0.4 | 5.0.5 |
com.hazelcast:hazelcastMaven | 5.1-BETA-1 up to 5.1.6, plus listed versions 5.15.1.15.1.25.1.35.1.45.1.5 | 5.1.6 |
com.hazelcast:hazelcastMaven | 5.2-BETA-1 up to 5.2.4, plus listed versions 5.2.05.2.15.2.25.2.3 | 5.2.4 |
com.hazelcast:hazelcastMaven | 5.3.0-BETA-1 up to 5.3.0, plus listed versions 5.3.0-BETA-2 | 5.3.0 |
What each source reports
NVD Score used
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
CVE-2023-33264- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
CVE ListNo score
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
CVE-2023-33264- Updated
- 2026-11-02
EUVDEUVD-2023-1474No score
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
EUVD-2023-1474- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gj6-62g7-vmgf
Hazelcast vulnerable to unmasked password exposure
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
GHSA-5gj6-62g7-vmgf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-522
- Updated
- 2026-11-02
OSVGHSA-5gj6-62g7-vmgf
Hazelcast vulnerable to unmasked password exposure
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
GHSA-5gj6-62g7-vmgf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-522
- Updated
- 2026-11-02
OSVCLSA-2026-1769990937No score
TuxCare security update for com.hazelcast (3 CVEs)
TuxCare rebuilt 2 com.hazelcast packages to address 3 CVEs. Fixed in 4.2.8-tuxcare.1.
- Record
CLSA-2026-1769990937- Updated
- 2026-11-02
OSVNo score
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Record
CVE-2023-33264- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/hazelcast/hazelcast/pull/24266
nvd.nist.gov/vuln/detail/CVE-2023-33264