{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T02:30:14.575","vulnerabilities":[{"cve":{"id":"CVE-2024-8642","sourceIdentifier":"emo@eclipse.org","published":"2024-09-11T14:15:14.177","lastModified":"2026-06-17T08:23:02.267","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module \"transfer-data-plane\". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed."},{"lang":"es","value":"En Eclipse Dataspace Components, desde la versión 0.5.0 y antes de la versión 0.9.0, el ConsumerPullTransferTokenValidationApiController no comprueba la validez del token (vencimiento, fecha anterior, fecha de emisión), lo que puede permitir que un atacante omita la comprobación de vencimiento del token. El problema requiere tener un plano de datos configurado para admitir la extracción del consumidor del proxy http E incluir el módulo \"transfer-data-plane\". El código afectado se marcó como obsoleto desde la versión 0.6.0 a favor de la señalización del plano de datos. En la versión 0.9.0, se eliminó el código vulnerable."}],"affected":[{"source":"emo@eclipse.org","affectedData":[{"vendor":"Eclipse Foundation","product":"Eclipse EDC Connector","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2/","packageName":"org.eclipse.edc:transfer-data-plane","modules":["transfer-data-plane"],"repo":"https://github.com/eclipse-edc/Connector","versions":[{"version":"0.5.0","lessThan":"0.9.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"eclipse_foundation","product":"edc","defaultStatus":"unknown","cpes":["cpe:2.3:a:eclipse_foundation:edc:0.5.0:*:*:*:*:*:*:*"],"versions":[{"version":"0.5.0","lessThan":"0.9.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"emo@eclipse.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Green","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"LOW","providerUrgency":"GREEN"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-11T14:03:51.264915Z","id":"CVE-2024-8642","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"emo@eclipse.org","type":"Secondary","description":[{"lang":"en","value":"CWE-303"},{"lang":"en","value":"CWE-305"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:eclipse:eclipse_dataspace_components:*:*:*:*:*:*:*:*","versionStartIncluding":"0.5.0","versionEndExcluding":"0.9.0","matchCriteriaId":"2888B4A6-45F7-4AA7-A1B5-13AA28E245D0"}]}]}],"references":[{"url":"https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6","source":"emo@eclipse.org","tags":["Patch"]},{"url":"https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0","source":"emo@eclipse.org","tags":["Release Notes"]},{"url":"https://gitlab.eclipse.org/security/cve-assignement/-/issues/28","source":"emo@eclipse.org","tags":["Issue Tracking"]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234","source":"emo@eclipse.org","tags":["Vendor Advisory"]}]}}]}