Description
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
Remediation
References
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp
Related Vulnerabilities
CVE-2017-16146 Vulnerability in npm package mockserve
CVE-2019-12043 Vulnerability in maven package org.webjars.npm:remarkable
CVE-2015-5255 Vulnerability in maven package org.apache.flex.blazeds:flex-messaging-core
CVE-2019-10359 Vulnerability in maven package org.jenkins-ci.plugins.m2release:m2release
CVE-2020-35209 Vulnerability in maven package io.atomix:atomix