PT-2020-16325
CVE-2020-26168
·
Published
2020-11-09
·
Updated
2020-11-18
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Hazelcast IMDG Enterprise versions 4.0.0 through 4.0.2
Hazelcast Jet Enterprise versions 4.0.0 through 4.2
Description
The LDAP authentication method in LdapLoginModule does not properly verify passwords in certain system-user-dn scenarios, allowing users to be authenticated with invalid passwords.
Recommendations
For Hazelcast IMDG Enterprise versions 4.0.0 through 4.0.2, update to version 4.0.3 or later.
For Hazelcast Jet Enterprise versions 4.0.0 through 4.2, consider disabling the LdapLoginModule until a patch is available.
Found an issue in the description? Have something to add? Feel free to write us 👾