CVE-2024-4536: edc connector Credential Exposure — Fix

Description

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL. This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.

Is your site exposed to CVE-2024-4536?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.8

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Weakness Type (CWE)

CWE-201 CWE-201

CWE-522 CWE-522

Affected Products

Vendor	Product	Versions
eclipse	edc_connector	0.2.1 — 0.6.3

References

Advisories & Patches

https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b https://gitlab.eclipse.org/security/cve-assignement/-/issues/22 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198 https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b https://gitlab.eclipse.org/security/cve-assignement/-/issues/22 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198

Other References

https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3 https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3

Frequently Asked Questions

What is CVE-2024-4536? +

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL. This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented. It has a CVSS v3.1 base score of 6.8 (MEDIUM).

How severe is CVE-2024-4536? +

CVE-2024-4536 has a CVSS v3.1 score of 6.8 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-4536? +

CVE-2024-4536 affects products from eclipse, specifically: edc_connector. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-4536? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-27868

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration …

CVE-2025-24858

Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the …

CVE-2025-48045

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.

CVE-2024-7205

When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take …

CVE-2025-8862

YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend …

CVE-2025-64502

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB …

CVE-2024-4536