{"id":"CVE-2023-33264","aliases":["CLSA-2026-1769990937","EUVD-2023-1474","GHSA-5gj6-62g7-vmgf"],"status":"published","title":"Hazelcast vulnerable to unmasked password exposure","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00719,"percentile":0.54161,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-522"],"published":"2023-05-22T00:00:00Z","modified":"2026-11-02T19:45:12Z","fixes":[{"ecosystem":"Maven","package":"com.hazelcast:hazelcast","fixed_in":["5.0.5","5.1.6","5.2.4","5.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0-BETA-1"},{"last_affected":"4.2.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0-BETA-1"},{"fixed":"5.0.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1-BETA-1"},{"fixed":"5.1.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2-BETA-1"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0-BETA-1"},{"fixed":"5.3.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.8"},{"fixed":"4.2.8-tuxcare.1"}]}],"versions":["4.2.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.hazelcast:hazelcast-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.8"},{"fixed":"4.2.8-tuxcare.1"}]}],"versions":["4.2.8"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0-BETA-1"},{"last_affected":"4.2.8"}]}],"versions":["4.0","4.0-BETA-1","4.0-BETA-2","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.1","4.1-BETA-1","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2","4.2-BETA-1","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0-BETA-1"},{"fixed":"5.0.5"}]}],"versions":["5.0","5.0-BETA-1","5.0-BETA-2","5.0.1","5.0.2","5.0.3","5.0.4"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1-BETA-1"},{"fixed":"5.1.6"}]}],"versions":["5.1","5.1-BETA-1","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2-BETA-1"},{"fixed":"5.2.4"}]}],"versions":["5.2-BETA-1","5.2.0","5.2.1","5.2.2","5.2.3"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0-BETA-1"},{"fixed":"5.3.0"}]}],"versions":["5.3.0-BETA-1","5.3.0-BETA-2"]}],"products":[{"vendor":"hazelcast","product":"hazelcast"}],"references":[{"url":"https://github.com/hazelcast/hazelcast/pull/24266","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33264","tags":["advisory"]},{"url":"https://github.com/hazelcast/hazelcast/pull/24266/commits/80a502d53cc48bf895711ab55f95e3a51e344ac1","tags":["web"]},{"url":"https://github.com/hazelcast/hazelcast/commit/74eed86c2b2b727148c442e98a01d0ca6941a49e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5gj6-62g7-vmgf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33264.json","tags":["advisory"]},{"url":"https://github.com/hazelcast/hazelcast","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-33264","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.","status":"published","published":"2023-05-22T00:00:00Z","modified":"2025-01-21T15:20:07.435Z","updated_at":"2026-11-02T14:35:34.170609Z"}],"euvd":[{"id":"EUVD-2023-1474","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.","status":"published","published":"2023-05-22T00:00:00Z","modified":"2025-01-21T15:20:07Z","updated_at":"2026-11-03T00:04:16.173755Z"}],"ghsa":[{"id":"GHSA-5gj6-62g7-vmgf","title":"Hazelcast vulnerable to unmasked password exposure","description":"In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.","status":"published","published":"2023-05-22T03:30:16Z","modified":"2025-10-02T21:15:03Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:38:59.83883Z"}],"nvd":[{"id":"CVE-2023-33264","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.","status":"published","published":"2023-05-22T01:15:44.333Z","modified":"2026-06-17T06:01:26.203Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"GHSA-5gj6-62g7-vmgf","title":"Hazelcast vulnerable to unmasked password exposure","description":"In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.","status":"published","published":"2023-05-22T03:30:16Z","modified":"2025-10-02T21:25:17.260328Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"CLSA-2026-1769990937","title":"TuxCare security update for com.hazelcast (3 CVEs)","description":"TuxCare rebuilt 2 com.hazelcast packages to address 3 CVEs. Fixed in 4.2.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.706351658Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CVE-2023-33264","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.","status":"published","published":"2023-05-22T00:00:00Z","modified":"2026-10-28T02:30:43.276472504Z","updated_at":"2026-11-02T15:44:32.116263Z"}]}}