Eclipse Dataspace Components vulnerabilities

2 CVEs affecting Eclipse Dataspace Components, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-9202, published 2024-09-27.

More from Eclipse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-8642, published 2024-09-11. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance…
• CVE-2024-9202, published 2024-09-27. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested catalog, to ensure that only authorized…