{"id":"GHSA-5gj6-62g7-vmgf","summary":"Hazelcast vulnerable to unmasked password exposure","details":"In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.","aliases":["CVE-2023-33264"],"modified":"2025-10-02T21:25:17.260328Z","published":"2023-05-22T03:30:16Z","database_specific":{"cwe_ids":["CWE-200","CWE-522"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-05-22T19:55:38Z","nvd_published_at":"2023-05-22T01:15:44Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33264"},{"type":"WEB","url":"https://github.com/hazelcast/hazelcast/pull/24266"},{"type":"WEB","url":"https://github.com/hazelcast/hazelcast/pull/24266/commits/80a502d53cc48bf895711ab55f95e3a51e344ac1"},{"type":"WEB","url":"https://github.com/hazelcast/hazelcast/commit/74eed86c2b2b727148c442e98a01d0ca6941a49e"},{"type":"PACKAGE","url":"https://github.com/hazelcast/hazelcast"}],"affected":[{"package":{"name":"com.hazelcast:hazelcast","ecosystem":"Maven","purl":"pkg:maven/com.hazelcast/hazelcast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0-BETA-1"},{"last_affected":"4.2.8"}]}],"versions":["4.0","4.0-BETA-1","4.0-BETA-2","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.1","4.1-BETA-1","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2","4.2-BETA-1","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-5gj6-62g7-vmgf/GHSA-5gj6-62g7-vmgf.json"}},{"package":{"name":"com.hazelcast:hazelcast","ecosystem":"Maven","purl":"pkg:maven/com.hazelcast/hazelcast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0-BETA-1"},{"fixed":"5.0.5"}]}],"versions":["5.0","5.0-BETA-1","5.0-BETA-2","5.0.1","5.0.2","5.0.3","5.0.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-5gj6-62g7-vmgf/GHSA-5gj6-62g7-vmgf.json"}},{"package":{"name":"com.hazelcast:hazelcast","ecosystem":"Maven","purl":"pkg:maven/com.hazelcast/hazelcast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1-BETA-1"},{"fixed":"5.1.6"}]}],"versions":["5.1","5.1-BETA-1","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-5gj6-62g7-vmgf/GHSA-5gj6-62g7-vmgf.json"}},{"package":{"name":"com.hazelcast:hazelcast","ecosystem":"Maven","purl":"pkg:maven/com.hazelcast/hazelcast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2-BETA-1"},{"fixed":"5.2.4"}]}],"versions":["5.2-BETA-1","5.2.0","5.2.1","5.2.2","5.2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-5gj6-62g7-vmgf/GHSA-5gj6-62g7-vmgf.json"}},{"package":{"name":"com.hazelcast:hazelcast","ecosystem":"Maven","purl":"pkg:maven/com.hazelcast/hazelcast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0-BETA-1"},{"fixed":"5.3.0"}]}],"versions":["5.3.0-BETA-1","5.3.0-BETA-2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-5gj6-62g7-vmgf/GHSA-5gj6-62g7-vmgf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}