CVE-2023-45860: SQL Injection
Impact In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.
Patches Fix versions: 5.3.5, 5.4.0-BETA-1
Workaround Disabling Hazelcast Jet processing engine in Hazelcast member configuration workarounds the issue. As a result SQL and Jet jobs won't work.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45860?
CVE-2023-45860 is classified as a high severity vulnerability due to the potential for unauthorized data access.
How do I fix CVE-2023-45860?
To mitigate CVE-2023-45860, upgrade to Hazelcast Platform version 5.3.5 or later, or version 5.2.5 for earlier affected releases.
What systems are affected by CVE-2023-45860?
CVE-2023-45860 affects versions of Hazelcast Platform from 5.2.0 to 5.3.4, including both the Hazelcast and Hazelcast Enterprise packages.
What is the impact of CVE-2023-45860 on system security?
The impact of CVE-2023-45860 is that it allows unauthorized clients to access sensitive data stored in the filesystem of a Hazelcast member.
Where can I find more information on CVE-2023-45860?
For detailed information on CVE-2023-45860, refer to the official Hazelcast security advisories and GitHub discussions.