CVE-2023-45860

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-16 · updated 2026-06-17
Weakness: CWE-89

Description

In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.

Affected products

hazelcast: through 5.1.7; from 5.2.0 before 5.2.5; from 5.3.0 before 5.3.5 — fixed in 5.2.5, 5.3.5

How to fix

Upgrade to a fixed version: hazelcast 5.2.5, 5.3.5. Check the vendor advisory for mitigations.

References

https://github.com/hazelcast/hazelcast/pull/25348
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99
https://github.com/hazelcast/hazelcast/pull/25348
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99

Get alerted when CVE-2023-45860 or the next vulnerability affects your stack