CVE-2024-9202

Katalog CVE

CVSS 5.3 · Medium EPSS 0,38%

Kerentanan Missing Authorization pada eclipse dataspace components. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single dataset, which should be subject to the same filtering process, but currently is missing the correct filtering. This enables parties to potentially see datasets they should not have access to, thereby exposing sensitive information. Exploiting this vulnerability requires knowing the ID of a restricted dataset, but some IDs may be guessed by trying out many IDs in an automated way. Affected code: DatasetResolverImpl, L76-79 https://github.com/eclipse-edc/Connector/blob/v0.9.0/core/control-plane/control-plane-catalog/src/main/java/org/eclipse/edc/connector/controlplane/catalog/DatasetResolverImpl.java

Rincian

Terbit di NVD

27 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.eclipse.org/security/cve-assignement/-/issues/35 issue tracking · advisory vendor
• https://github.com/eclipse-edc/Connector/pull/4490 issue tracking · patch
• https://github.com/eclipse-edc/Connector/pull/4491 issue tracking · patch