CVE-2024-9202
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
27/09/2024
Last modified:
09/01/2025
Description
In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers.<br />
However, there is the possibility to request a single dataset, which should be subject to the same filtering process, but currently is missing the correct filtering.<br />
<br />
<br />
This enables parties to potentially see datasets they should not have access to, thereby exposing sensitive information. Exploiting this vulnerability requires knowing the ID of a restricted dataset, but some IDs may be guessed by trying out many IDs in an automated way.<br />
<br />
<br />
Affected code:<br />
DatasetResolverImpl, L76-79 https://github.com/eclipse-edc/Connector/blob/v0.9.0/core/control-plane/control-plane-catalog/src/main/java/org/eclipse/edc/connector/controlplane/catalog/DatasetResolverImpl.java
Impact
Base Score 4.0
5.30
Severity 4.0
MEDIUM
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:eclipse:eclipse_dataspace_components:*:*:*:*:*:*:*:* | 0.1.3 (including) | 0.9.1 (excluding) |
To consult the complete list of CPE names with products and versions, see this page