Vulnerability-Lookup

CVE-2024-4536 (GCVE-0-2024-4536)

Vulnerability from cvelistv5 – Published: 2024-05-07 13:11 – Updated: 2024-08-01 20:40

Title

Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability

Summary

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL. This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-07 14:50 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data
CWE-522 - Insufficiently Protected Credentials

Assigner

eclipse CNA under the mitre root

CNA scorecard C 66/100 over 204 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/eclipse-edc/Connector/commit/a…	patch
https://github.com/eclipse-edc/Connector/releases…	related
https://gitlab.eclipse.org/security/cve-assigneme…	issue-trackingvendor-advisory
https://gitlab.eclipse.org/security/vulnerability…	issue-trackingvendor-advisory

Impacted products

2 products

Vendor	Product	Version	CPE status
Eclipse Foundation	EDC	Affected: 0.2.1 , ≤ 0.6.2 (semver)	guessed
eclipse_foundation	edc	Affected: 0.2.1 cpe:2.3:a:eclipse_foundation:edc::::::::

Credits

sovity GmbH

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:eclipse_foundation:edc:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "edc",
            "vendor": "eclipse_foundation",
            "versions": [
              {
                "status": "affected",
                "version": "0.2.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4536",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-07T14:50:50.630941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:53:35.014Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:40:47.492Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
          },
          {
            "tags": [
              "issue-tracking",
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
          },
          {
            "tags": [
              "issue-tracking",
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Connector"
          ],
          "packageName": "technology.edc",
          "product": "EDC",
          "repo": "https://github.com/eclipse-edc/Connector",
          "vendor": "Eclipse Foundation",
          "versions": [
            {
              "lessThanOrEqual": "0.6.2",
              "status": "affected",
              "version": "0.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "sovity GmbH"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/eclipse-edc/Connector\"\u003ehttps://github.com/eclipse-edc/Connector\u003c/a\u003e), an attacker might obtain OAuth2 client secrets from the vault.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/eclipse-edc/Connector\"\u003ehttps://github.com/eclipse-edc/Connector\u003c/a\u003e) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider\u0027s vault, not the consumer. This secret\u0027s value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\u003c/p\u003e\n\u003cp\u003eThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\u003c/p\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider\u0027s vault, not the consumer. This secret\u0027s value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-07T13:11:45.310Z",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
        },
        {
          "tags": [
            "issue-tracking",
            "vendor-advisory"
          ],
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
        },
        {
          "tags": [
            "issue-tracking",
            "vendor-advisory"
          ],
          "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2024-4536",
    "datePublished": "2024-05-07T13:11:45.310Z",
    "dateReserved": "2024-05-06T07:05:31.518Z",
    "dateUpdated": "2024-08-01T20:40:47.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-4536",
      "date": "2026-11-08",
      "epss": "0.00411",
      "percentile": "0.35674"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "modules": [
                  "Connector"
                ],
                "packageName": "technology.edc",
                "product": "EDC",
                "repo": "https://github.com/eclipse-edc/Connector",
                "vendor": "Eclipse Foundation",
                "versions": [
                  {
                    "lessThanOrEqual": "0.6.2",
                    "status": "affected",
                    "version": "0.2.1",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "emo@eclipse.org"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:eclipse_foundation:edc:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "edc",
                "vendor": "eclipse_foundation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0.2.1"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:eclipse:edc_connector:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "08F7DB6D-051E-4FC3-9213-D77CA98120E6",
                    "versionEndExcluding": "0.6.3",
                    "versionStartIncluding": "0.2.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider\u0027s vault, not the consumer. This secret\u0027s value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n"
          },
          {
            "lang": "es",
            "value": "En los componentes de Eclipse Dataspace de la versi\u00f3n 0.2.1 a 0.6.2, en el componente EDC Connector (https://github.com/eclipse-edc/Connector), un atacante podr\u00eda obtener secretos del cliente OAuth2 de la b\u00f3veda. En los componentes de Eclipse Dataspace de la versi\u00f3n 0.2.1 a 0.6.2, hemos identificado una vulnerabilidad de seguridad en el componente EDC Connector (https://github.com/eclipse-edc/Connector) con respecto a la funci\u00f3n de receptor de datos protegido por OAuth2. Cuando se utiliza un receptor de datos personalizado protegido por OAuth2, el plano de datos del proveedor resuelve las propiedades de direcci\u00f3n de datos espec\u00edficas de OAuth2. Lo problem\u00e1tico es que la clientSecretKey proporcionada por el consumidor, que indica el secreto del cliente OAuth2 para recuperar de una b\u00f3veda de secretos, se resuelve en el contexto de la b\u00f3veda del proveedor, no en el del consumidor. Luego, el valor de este secreto se env\u00eda a tokenUrl, tambi\u00e9n controlado por el consumidor, como parte de una concesi\u00f3n de credenciales de cliente OAuth2. El token de acceso devuelto se env\u00eda luego como token de portador a la URL del receptor de datos. Esta caracter\u00edstica ahora est\u00e1 completamente deshabilitada porque no se implementaron completamente todas las rutas de c\u00f3digo necesarias para una realizaci\u00f3n exitosa."
          }
        ],
        "id": "CVE-2024-4536",
        "lastModified": "2026-06-17T08:02:05.680",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.3,
              "source": "emo@eclipse.org",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 0.5,
              "impactScore": 4.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-4536",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-07T14:50:50.630941Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-07T13:15:48.513",
        "references": [
          {
            "source": "emo@eclipse.org",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
          },
          {
            "source": "emo@eclipse.org",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
          },
          {
            "source": "emo@eclipse.org",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
          },
          {
            "source": "emo@eclipse.org",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
          }
        ],
        "sourceIdentifier": "emo@eclipse.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-201"
              },
              {
                "lang": "en",
                "value": "CWE-522"
              }
            ],
            "source": "emo@eclipse.org",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-522"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:50:46+00:00",
      "cve": "CVE-2024-4536",
      "id": "CVE-2024-4536",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-4536.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T20:40:47.492Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "patch",
                  "x_transferred"
                ],
                "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
              },
              {
                "tags": [
                  "related",
                  "x_transferred"
                ],
                "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
              },
              {
                "tags": [
                  "issue-tracking",
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
              },
              {
                "tags": [
                  "issue-tracking",
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:eclipse_foundation:edc:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "edc",
                "vendor": "eclipse_foundation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0.2.1"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-4536",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-07T14:50:50.630941Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-07T14:57:50.407Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "Connector"
              ],
              "packageName": "technology.edc",
              "product": "EDC",
              "repo": "https://github.com/eclipse-edc/Connector",
              "vendor": "Eclipse Foundation",
              "versions": [
                {
                  "lessThanOrEqual": "0.6.2",
                  "status": "affected",
                  "version": "0.2.1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "sovity GmbH"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cdiv\u003eIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/eclipse-edc/Connector\"\u003ehttps://github.com/eclipse-edc/Connector\u003c/a\u003e), an attacker might obtain OAuth2 client secrets from the vault.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/eclipse-edc/Connector\"\u003ehttps://github.com/eclipse-edc/Connector\u003c/a\u003e) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider\u0027s vault, not the consumer. This secret\u0027s value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\u003c/p\u003e\n\u003cp\u003eThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\u003c/p\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e"
                }
              ],
              "value": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider\u0027s vault, not the consumer. This secret\u0027s value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-201",
                  "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-522",
                  "description": "CWE-522: Insufficiently Protected Credentials",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-05-07T13:11:45.310Z",
            "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
            "shortName": "eclipse"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
            },
            {
              "tags": [
                "issue-tracking",
                "vendor-advisory"
              ],
              "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
            },
            {
              "tags": [
                "issue-tracking",
                "vendor-advisory"
              ],
              "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "assignerShortName": "eclipse",
        "cveId": "CVE-2024-4536",
        "datePublished": "2024-05-07T13:11:45.310Z",
        "dateReserved": "2024-05-06T07:05:31.518Z",
        "dateUpdated": "2024-08-01T20:40:47.492Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-4536

Vulnerability from fkie_nvd - Published: 2024-05-07 13:15 - Updated: 2026-06-17 08:02

Severity

6.8 (Medium) - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
5.3 (Medium) - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L

Summary

References

URL	Tags
emo@eclipse.org	https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b	Patch
emo@eclipse.org	https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3	Release Notes
emo@eclipse.org	https://gitlab.eclipse.org/security/cve-assignement/-/issues/22	Issue Tracking, Vendor Advisory
emo@eclipse.org	https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198	Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://gitlab.eclipse.org/security/cve-assignement/-/issues/22	Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198	Issue Tracking, Vendor Advisory

Impacted products

	Vendor	Product	Version
	eclipse	edc_connector	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Connector"
          ],
          "packageName": "technology.edc",
          "product": "EDC",
          "repo": "https://github.com/eclipse-edc/Connector",
          "vendor": "Eclipse Foundation",
          "versions": [
            {
              "lessThanOrEqual": "0.6.2",
              "status": "affected",
              "version": "0.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "emo@eclipse.org"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:eclipse_foundation:edc:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "edc",
          "vendor": "eclipse_foundation",
          "versions": [
            {
              "status": "affected",
              "version": "0.2.1"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:edc_connector:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "08F7DB6D-051E-4FC3-9213-D77CA98120E6",
              "versionEndExcluding": "0.6.3",
              "versionStartIncluding": "0.2.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider\u0027s vault, not the consumer. This secret\u0027s value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n"
    },
    {
      "lang": "es",
      "value": "En los componentes de Eclipse Dataspace de la versi\u00f3n 0.2.1 a 0.6.2, en el componente EDC Connector (https://github.com/eclipse-edc/Connector), un atacante podr\u00eda obtener secretos del cliente OAuth2 de la b\u00f3veda. En los componentes de Eclipse Dataspace de la versi\u00f3n 0.2.1 a 0.6.2, hemos identificado una vulnerabilidad de seguridad en el componente EDC Connector (https://github.com/eclipse-edc/Connector) con respecto a la funci\u00f3n de receptor de datos protegido por OAuth2. Cuando se utiliza un receptor de datos personalizado protegido por OAuth2, el plano de datos del proveedor resuelve las propiedades de direcci\u00f3n de datos espec\u00edficas de OAuth2. Lo problem\u00e1tico es que la clientSecretKey proporcionada por el consumidor, que indica el secreto del cliente OAuth2 para recuperar de una b\u00f3veda de secretos, se resuelve en el contexto de la b\u00f3veda del proveedor, no en el del consumidor. Luego, el valor de este secreto se env\u00eda a tokenUrl, tambi\u00e9n controlado por el consumidor, como parte de una concesi\u00f3n de credenciales de cliente OAuth2. El token de acceso devuelto se env\u00eda luego como token de portador a la URL del receptor de datos. Esta caracter\u00edstica ahora est\u00e1 completamente deshabilitada porque no se implementaron completamente todas las rutas de c\u00f3digo necesarias para una realizaci\u00f3n exitosa."
    }
  ],
  "id": "CVE-2024-4536",
  "lastModified": "2026-06-17T08:02:05.680",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.3,
        "source": "emo@eclipse.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 4.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4536",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-07T14:50:50.630941Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-07T13:15:48.513",
  "references": [
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
    }
  ],
  "sourceIdentifier": "emo@eclipse.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        },
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "emo@eclipse.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-2X52-8F29-7CJR

Vulnerability from github – Published: 2024-05-07 15:30 – Updated: 2025-02-06 19:33

Summary

Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure

Details

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component, an attacker might obtain OAuth2 client secrets from the vault.

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.

This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.edc:connector-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.1"
            },
            {
              "fixed": "0.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-4536"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-201",
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-07T16:51:10Z",
    "nvd_published_at": "2024-05-07T13:15:48Z",
    "severity": "MODERATE"
  },
  "details": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the [EDC Connector component](https://github.com/eclipse-edc/Connector), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider\u0027s vault, not the consumer. This secret\u0027s value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.",
  "id": "GHSA-2x52-8f29-7cjr",
  "modified": "2025-02-06T19:33:44Z",
  "published": "2024-05-07T15:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4536"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eclipse-edc/Connector"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-4536 (GCVE-0-2024-4536)

FKIE_CVE-2024-4536

GHSA-2X52-8F29-7CJR

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour