GitHub Advisoryadvisory · Maven

GHSA-8259-2x72-2gvc Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit

MEDIUM Published 2024-09-11 Modified 2026-02-02 Official page ↗
Aliases
CVE-2024-8642
Ecosystem
Maven
Packages
org.eclipse.edc:transfer-data-plane
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-287, CWE-303
Reviewed
2024-09-11

Affected packages

• Maven org.eclipse.edc:transfer-data-plane: >= 0.5.0, < 0.9.0 → fixed in 0.9.0

Description

In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.

Related

Alias · CVE (1)

  • CVE-2024-8642 In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness

References