CVE-2022-36437 - CVE House
Back to Database
Status published Unknown CVE-2022-36437

The Connection handler in Hazelcast and Hazelcast Jet allows a...

Vulnerability Description

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-36437

Credits & Attribution

No credits recorded in the NVD database.

References

More from hazelcast

View All →
CVE-2022-0265
Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
High 7.3
CVE-2020-26168
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise...
Critical 9.8
CVE-2016-10750
In Hazelcast before 3.11, the cluster join procedure is vulnerable...
High 8.1

Affected Vendor

Affected Software

hazelcast, hazelcast-jet
Vulnerable Versions:
0, 4.0.0, 4.2.0, 5.0.0, 5.1.0

Timeline

Official Publish: December 29th, 2022
Last Modified: April 11th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.