CVE-2024-8642

Katalog CVE

CVSS 8.1 · High EPSS 0,41%

Kerentanan Incorrect Implementation of Authentication Algorithm pada eclipse dataspace components. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.

Rincian

Terbit di NVD

11 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-303: Incorrect Implementation of Authentication Algorithm
CWE-305: Authentication Bypass by Primary Weakness
CWE-287: Improper Authentication

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234 advisory vendor
• https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6 patch
• https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0 release notes
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/28 issue tracking