org.eclipse.edc/transfer-data-plane vulnerabilities

Latest org.eclipse.edc/transfer-data-plane CVEs

Newest publication first

1. CVE-2024-8642 Eclipse EDC: Consumer pull transfer token validation checks not applied

   Published 2024-09-11

   Medium·CVSS 5.0 EPSS 0.41%

   In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.