[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTq_Qrl01tVffK0dpjqJST0xawhq8b9lhGiA5tL4i_qU":3,"g5a-risk:CVE-2024-8642":135},{"success":4,"data":5,"meta":132},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":43,"epssPercentile":28,"epssTimeSeries":44,"severity":45,"affectedProducts":46,"affectedProductsCount":52,"references":53,"referencesCount":72,"weaknesses":73,"weaknessesCount":92,"isActivelyExploited":93,"cisaInfo":28,"otxData":28,"relatedBlogPosts":94,"seoMetadata":95,"configurations":120,"relatedVendorCves":130,"notableEvents":131},"CVE-2024-8642","What is CVE-2024-8642?","In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module \"transfer-data-plane\". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.","In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token v...","2024-09-11T14:15:14.177","2026-06-17T08:23:02.267",5.1,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:H\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:H\u002FSI:H\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:L\u002FU:Green",{"CVSSMetricV31":15,"CVSSMetricV30":31,"CVSSMetricV2":32,"CVSSMetricV40":33},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"nvd@nist.gov","Primary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":24,"BaseScore":27,"BaseSeverity":26,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N","NETWORK","LOW","NONE","UNCHANGED","HIGH",8.1,null,2.8,5.2,[],[],[34],{"Source":35,"Type":36,"CVSSData":37},"emo@eclipse.org","Secondary",{"Version":38,"VectorString":13,"BaseScore":12,"BaseSeverity":39,"AttackVector":22,"AttackComplexity":23,"AttackRequirements":40,"PrivilegesRequired":26,"UserInteraction":24,"VulnConfidentialityImpact":24,"VulnIntegrityImpact":24,"VulnAvailabilityImpact":24,"SubConfidentialityImpact":26,"SubIntegrityImpact":26,"SubAvailabilityImpact":24,"ExploitMaturity":41,"ConfidentialityRequirement":41,"IntegrityRequirement":41,"AvailabilityRequirement":41,"ModifiedAttackVector":41,"ModifiedAttackComplexity":41,"ModifiedAttackRequirements":41,"ModifiedPrivilegesRequired":41,"ModifiedUserInteraction":41,"ModifiedVulnConfidentialityImpact":41,"ModifiedVulnIntegrityImpact":41,"ModifiedVulnAvailabilityImpact":41,"ModifiedSubConfidentialityImpact":41,"ModifiedSubIntegrityImpact":41,"ModifiedSubAvailabilityImpact":41,"Safety":41,"Automatable":41,"Recovery":41,"ValueDensity":41,"VulnerabilityResponseEffort":23,"ProviderUrgency":42},"4.0","MEDIUM","PRESENT","NOT_DEFINED","GREEN",0.00407,[43,43,43,43,43,43,43],"Medium",[47],{"vendor":48,"product":49,"version":50,"criteria":51,"vulnerable":4},"eclipse","eclipse_dataspace_components","*","cpe:2.3:a:eclipse:eclipse_dataspace_components:*:*:*:*:*:*:*:*",1,[54,59,63,68],{"url":55,"source":56,"tags":57},"https:\u002F\u002Fgithub.com\u002Feclipse-edc\u002FConnector\u002Fcommit\u002F04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6","GitHub",[58],"Patch",{"url":60,"source":56,"tags":61},"https:\u002F\u002Fgithub.com\u002Feclipse-edc\u002FConnector\u002Freleases\u002Ftag\u002Fv0.9.0",[62],"Release Notes",{"url":64,"source":65,"tags":66},"https:\u002F\u002Fgitlab.eclipse.org\u002Fsecurity\u002Fcve-assignement\u002F-\u002Fissues\u002F28","Eclipse",[67],"Issue Tracking",{"url":69,"source":65,"tags":70},"https:\u002F\u002Fgitlab.eclipse.org\u002Fsecurity\u002Fvulnerability-reports\u002F-\u002Fissues\u002F234",[71],"Vendor Advisory",4,[74,82,88],{"id":75,"name":76,"description":77,"extendedDescription":78,"status":79,"abstraction":80,"structure":81},"CWE-303","Incorrect Implementation of Authentication Algorithm","The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.","This incorrect implementation may allow authentication to be bypassed.","Draft","Base","Simple",{"id":83,"name":84,"description":85,"extendedDescription":86,"status":79,"abstraction":87,"structure":81},"CWE-287","Improper Authentication","When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","","Class",{"id":89,"name":90,"description":91,"extendedDescription":86,"status":79,"abstraction":80,"structure":81},"CWE-305","Authentication Bypass by Primary Weakness","The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.",3,false,[],{"title":96,"metaDescription":97,"keywords":98,"canonicalUrl":99,"structuredData":100},"What is CVE-2024-8642? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2024-8642, a medium severity cyber security vulnerability from 2024. In Eclipse Dataspace Components, from version 0.5.0 and be...","CVE-2024-8642, CVE-2024-8642 vulnerability, CVE-2024-8642 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2024, CVSS score, exploit, patch, remediation, eclipse security, eclipse_dataspace_components vulnerability","\u002Fwhat-is\u002Fcve-2024-8642",{"@context":101,"@type":102,"headline":96,"description":97,"datePublished":10,"dateModified":11,"author":103,"publisher":107,"about":111,"mainEntityOfPage":115,"articleSection":118,"keywords":119},"https:\u002F\u002Fschema.org","TechArticle",{"@type":104,"name":105,"url":106},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":104,"name":105,"url":106,"logo":108},{"@type":109,"url":110},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":112,"name":6,"description":113,"additionalType":114},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":116,"@id":117},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2024-8642","Cybersecurity","CVE-2024-8642, CVE-2024-8642 vulnerability, CVE-2024-8642 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[121],{"Operator":28,"Negate":28,"Nodes":122},[123],{"Operator":124,"Negate":93,"CPEMatch":125},"OR",[126],{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":127,"VersionStartExcluding":28,"VersionStartIncluding":128,"VersionEndExcluding":129,"VersionEndIncluding":28},"2888B4A6-45F7-4AA7-A1B5-13AA28E245D0","0.5.0","0.9.0",[],[],{"lastModified":11,"cacheTime":133,"version":134},1792275697442,"2.0",{"score":136,"band":45,"action":137,"scoredAt":138},46,"Plan remediation","2026-10-16T07:03:49.19197+00:00"]