Vulnerability · Published Dec 29, 2022 · Assigned by mitre
CVE-2022-36437
Critical 9.1
In plain English
A critical-severity session fixation in the com.hazelcast.jet:hazelcast-jet package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.hazelcast.jet:hazelcast-jet | 4.5.4 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast.jet:hazelcast-jet-enterprise | 4.5.4 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast | 4.1.10 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast | 4.2.6 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast | 5.0.4 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast | 5.1.3 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast | 3.12.13 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast | no fix listed | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast-enterprise | 3.12.13 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast-enterprise | no fix listed | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast-enterprise | 4.1.10 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast-enterprise | 4.2.6 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast-enterprise | 5.0.4 | GHSA-c5hg-mr8r-f6jp |
| Maven | com.hazelcast:hazelcast-enterprise | 5.1.3 | GHSA-c5hg-mr8r-f6jp |
Affected products (as reported)
Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N