{"action":"Upgrade org.eclipse.edc:transfer-data-plane to 0.9.0 or later.","affected":[{"fixed":"0.9.0","introduced":"0.5.0"}],"component":"org.eclipse.edc:transfer-data-plane","cve_ids":["CVE-2024-8642"],"ecosystem":"Maven","epss":0.00407,"exploited":false,"fixed_versions":["0.9.0"],"ghsa_id":"GHSA-8259-2x72-2gvc","id":"tcs_01M5N8KG2X961SBTRV9MKA5493","modified_at":"2026-02-03T03:13:33.997874Z","published_at":"2024-09-11T15:31:12Z","references":["https://osv.dev/vulnerability/GHSA-8259-2x72-2gvc","https://nvd.nist.gov/vuln/detail/CVE-2024-8642","https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6","https://github.com/eclipse-edc/Connector","https://github.com/eclipse-edc/Connector/blob/bcb2e42aee82ce1863be3dcbdab29919d39a0e97/extensions/control-plane/transfer/transfer-data-plane/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataplane/api/ConsumerPullTransferTokenValidationApiController.java","https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0","https://gitlab.eclipse.org/security/cve-assignment/-/issues/28","https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-8259-2x72-2gvc","url":"https://osv.dev/vulnerability/GHSA-8259-2x72-2gvc"}],"summary":"Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit"}