AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

atlasGHSA-p782-4j23-xqcg

Apache Atlas: zip path traversal in import functionality

atlas

CVE-2022-34271 · Published Dec 14, 2022 · updated Nov 8, 2023

High8.8
Fix: upgrade to 2.3.0 or later
GitHub advisory

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

Affected versions

PackageAffectedFixed in
org.apache.atlas:apache-atlas
Maven
>= 0.8.4, < 2.3.02.3.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22
Also known as
CVE-2022-34271

More atlas advisories

All atlas
High 7.1May 4Apache Atlas has a Code Injection VulnerabilityCVE-2026-40563fixed in 2.5.0Medium 7.1Feb 13, 2025Apache Atlas: An authenticated user can perform XSS and potentially impersonate another userCVE-2024-46910fixed in 2.4.0Medium 6.1Feb 10, 2022Cross-site scripting in Apache AtlasCVE-2020-13928fixed in 2.1.0Medium 6.1Jan 8, 2020Stored XSS in Apache AtlasCVE-2019-10070fixed in 0.8.4 +1High 7.5Aug 29, 2017Apache Atlas versions 0.6.0CVE-2016-8752no fix yetMedium 6.1Aug 29, 2017Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookiesCVE-2017-3150no fix yet