Information Exposure Through Sent Data Affecting org.eclipse.edc:data-plane-http-oauth2-core package, versions [0.2.1,0.6.3)
Threat Intelligence
EPSS
0.05% (16th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGECLIPSEEDC-6814554
- published 8 May 2024
- disclosed 7 May 2024
- credit Unknown
Introduced: 7 May 2024
CVE-2024-4536 Open this link in a new tabHow to fix?
Upgrade org.eclipse.edc:data-plane-http-oauth2-core to version 0.6.3 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure Through Sent Data by resolving the clientSecretKey in the context of a provider's vault when it should be resolved in the consumer's. A user in the same dataspace can expose OAuth2-protected client data, which is sent to a consumer-controlled tokenUrl as part of an OAuth2 client credentials grant, and subsequently used as a bearer token.
CVSS Scores
version 3.1