[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f62mgG7x2rfmuqSI9jzAp5G_JQRvM_SzZN3f-vmvPbC4":3,"g5a-risk:CVE-2024-9202":119},{"success":4,"data":5,"meta":116},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":42,"epssPercentile":28,"epssTimeSeries":43,"severity":44,"affectedProducts":45,"affectedProductsCount":51,"references":52,"referencesCount":67,"weaknesses":68,"weaknessesCount":51,"isActivelyExploited":77,"cisaInfo":28,"otxData":28,"relatedBlogPosts":78,"seoMetadata":79,"configurations":104,"relatedVendorCves":114,"notableEvents":115},"CVE-2024-9202","What is CVE-2024-9202?","In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers.\nHowever, there is the possibility to request a single dataset, which should be subject to the same filtering process, but currently is missing the correct filtering.\n\n\nThis enables parties to potentially see datasets they should not have access to, thereby exposing sensitive information. Exploiting this vulnerability requires knowing the ID of a restricted dataset, but some IDs may be guessed by trying out many IDs in an automated way.\n\n\nAffected code:\n DatasetResolverImpl, L76-79 https:\u002F\u002Fgithub.com\u002Feclipse-edc\u002FConnector\u002Fblob\u002Fv0.9.0\u002Fcore\u002Fcontrol-plane\u002Fcontrol-plane-catalog\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Feclipse\u002Fedc\u002Fconnector\u002Fcontrolplane\u002Fcatalog\u002FDatasetResolverImpl.java","In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested ...","2024-09-27T10:15:02.827","2026-06-17T08:24:07.9",5.3,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:L\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:M\u002FU:Amber",{"CVSSMetricV31":15,"CVSSMetricV30":31,"CVSSMetricV2":32,"CVSSMetricV40":33},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"nvd@nist.gov","Primary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":25,"Scope":26,"ConfidentialityImpact":23,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","NETWORK","HIGH","LOW","NONE","UNCHANGED","MEDIUM",null,1.6,3.6,[],[],[34],{"Source":35,"Type":36,"CVSSData":37},"emo@eclipse.org","Secondary",{"Version":38,"VectorString":13,"BaseScore":12,"BaseSeverity":27,"AttackVector":22,"AttackComplexity":24,"AttackRequirements":25,"PrivilegesRequired":24,"UserInteraction":25,"VulnConfidentialityImpact":24,"VulnIntegrityImpact":25,"VulnAvailabilityImpact":25,"SubConfidentialityImpact":24,"SubIntegrityImpact":25,"SubAvailabilityImpact":25,"ExploitMaturity":39,"ConfidentialityRequirement":39,"IntegrityRequirement":39,"AvailabilityRequirement":39,"ModifiedAttackVector":39,"ModifiedAttackComplexity":39,"ModifiedAttackRequirements":39,"ModifiedPrivilegesRequired":39,"ModifiedUserInteraction":39,"ModifiedVulnConfidentialityImpact":39,"ModifiedVulnIntegrityImpact":39,"ModifiedVulnAvailabilityImpact":39,"ModifiedSubConfidentialityImpact":39,"ModifiedSubIntegrityImpact":39,"ModifiedSubAvailabilityImpact":39,"Safety":39,"Automatable":39,"Recovery":39,"ValueDensity":39,"VulnerabilityResponseEffort":40,"ProviderUrgency":41},"4.0","NOT_DEFINED","MODERATE","AMBER",0.00377,[42,42,42,42,42,42,42],"Medium",[46],{"vendor":47,"product":48,"version":49,"criteria":50,"vulnerable":4},"eclipse","eclipse_dataspace_components","*","cpe:2.3:a:eclipse:eclipse_dataspace_components:*:*:*:*:*:*:*:*",1,[53,59,62],{"url":54,"source":55,"tags":56},"https:\u002F\u002Fgithub.com\u002Feclipse-edc\u002FConnector\u002Fpull\u002F4490","GitHub",[57,58],"Issue Tracking","Patch",{"url":60,"source":55,"tags":61},"https:\u002F\u002Fgithub.com\u002Feclipse-edc\u002FConnector\u002Fpull\u002F4491",[57,58],{"url":63,"source":64,"tags":65},"https:\u002F\u002Fgitlab.eclipse.org\u002Fsecurity\u002Fcve-assignement\u002F-\u002Fissues\u002F35","Eclipse",[57,66],"Vendor Advisory",3,[69],{"id":70,"name":71,"description":72,"extendedDescription":73,"status":74,"abstraction":75,"structure":76},"CWE-862","Missing Authorization","The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.\nWhen access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.","Incomplete","Class","Simple",false,[],{"title":80,"metaDescription":81,"keywords":82,"canonicalUrl":83,"structuredData":84},"What is CVE-2024-9202? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2024-9202, a medium severity cyber security vulnerability from 2024. In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, t...","CVE-2024-9202, CVE-2024-9202 vulnerability, CVE-2024-9202 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2024, CVSS score, exploit, patch, remediation, eclipse security, eclipse_dataspace_components vulnerability","\u002Fwhat-is\u002Fcve-2024-9202",{"@context":85,"@type":86,"headline":80,"description":81,"datePublished":10,"dateModified":11,"author":87,"publisher":91,"about":95,"mainEntityOfPage":99,"articleSection":102,"keywords":103},"https:\u002F\u002Fschema.org","TechArticle",{"@type":88,"name":89,"url":90},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":88,"name":89,"url":90,"logo":92},{"@type":93,"url":94},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":96,"name":6,"description":97,"additionalType":98},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":100,"@id":101},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2024-9202","Cybersecurity","CVE-2024-9202, CVE-2024-9202 vulnerability, CVE-2024-9202 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[105],{"Operator":28,"Negate":28,"Nodes":106},[107],{"Operator":108,"Negate":77,"CPEMatch":109},"OR",[110],{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":111,"VersionStartExcluding":28,"VersionStartIncluding":112,"VersionEndExcluding":113,"VersionEndIncluding":28},"19307830-8F92-4DE4-9921-4E8204DD647E","0.1.3","0.9.1",[],[],{"lastModified":11,"cacheTime":117,"version":118},1792275697466,"2.0",{"score":120,"band":121,"action":122,"scoredAt":123},18,"Info","Track","2026-10-16T07:03:55.755991+00:00"]