The Eclipse Foundation is a [Common Vulnerabilities and Exposures](https://cve.mitre.org/) (CVE) Numbering Authority. This issue it used to request and track the progress of the assignment of a CVE for a vulnerability in the project code for an Eclipse open source project. ## Basic information **Project name:** Eclipse Dataspace Components (EDC) **Project id:** technology.edc **Request type:** publication <!-- Required (if publication). Specify the version range as precisely as possible, e.g., "[3.0, 3.5.1]" or "[3.0, 3.5.1)". Note that using the standard range notion, square brackets are inclusive (i.e., that version is included in the range), and round brakets are exclusive (the vulnerability affects all versions up to but not including the named version). Multiple ranges can be provided. --> **Versions affected:** EDC versions from [0.1.3, 0.9.0] and fixed for versions >= 0.9.1 **Common Vulnerability Scoring System:** We rate the vulnerability as CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/RE:M/U:Amber, see {[cvss](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/RE:M/U:Amber)} **Summary:** In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single dataset, which should be subject to the same filtering process, but currently is missing the correct filtering. This enables parties to potentially see datasets they should not have access to, thereby exposing sensitive information. Exploiting this vulnerability requires knowing the ID of a restricted dataset, but some IDs may be guessed by trying out many IDs in an automated way. Affected code: [DatasetResolverImpl, L76-79](https://github.com/eclipse-edc/Connector/blob/v0.9.0/core/control-plane/control-plane-catalog/src/main/java/org/eclipse/edc/connector/controlplane/catalog/DatasetResolverImpl.java) **Links:** - [Main fix](https://github.com/eclipse-edc/Connector/pull/4490) - [Backport 0.9.1](https://github.com/eclipse-edc/Connector/pull/4491) ## Tracking **This section will completed by the project team**. - [ ] Reserve an entry only - [X] We're ready for this issue to be reported to the central authority (i.e., make this public now) - [X] (when applicable) The GitHub Security Advisory is ready to be published now Note that for those projects that host their repositories on GitHub, the use of GitHub Security Advisories is recommended but is not required. **This section will be completed by the EMO**. **CVE:** {cve} - [ ] All required information is provided - [x] CVE Assigned - [ ] Pushed to Mitre - [ ] Accepted by Mitre <!-- Quick actions will configure the state of the issue. Leave these. -->