CVE-2024-56518

Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client configuration file), which can be uploaded at the /cluster-connections URI.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2025-04-17

Last modified

2025-04-22

Weaknesses

CWE-94

Affected products

• Management Center (Hazelcast)

References

• https://docs.hazelcast.com/management-center/6.0-snapshot/getting-started/install
• https://gist.github.com/azraelxuemo/c3d42739aa3306a41111ef603dc65b4c