Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.eclipse.edc:transfer-data-plane | >= 0.5.0, < 0.9.0 | 0.9.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8642
- https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6
- https://github.com/eclipse-edc/Connector
- https://github.com/eclipse-edc/Connector/blob/bcb2e42aee82ce1863be3dcbdab29919d39a0e97/extensions/control-plane/transfer/transfer-data-plane/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataplane/api/ConsumerPullTransferTokenValidationApiController.java
- https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/28
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N- Weakness (CWE)
CWE-287, CWE-303- Platform
- Java / Kotlin (Maven)
- Package
org.eclipse.edc:transfer-data-plane- Disclosed
- 11.09.2024
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8259-2x72-2gvc - CC BY 4.0
Vulnerability history: org.eclipse.edc:transfer-data-plane
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.