AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

atlasGHSA-x3v6-f5fr-4wwv

Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user

atlas

CVE-2024-46910 · Published Feb 13, 2025

Medium7.1
Fix: upgrade to 2.4.0 or later
GitHub advisory

An authenticated user can perform XSS and potentially impersonate another user.

This issue affects Apache Atlas versions 2.3.0 and earlier.

Users are recommended to upgrade to version 2.4.0, which fixes the issue.

Affected versions

PackageAffectedFixed in
org.apache.atlas:apache-atlas
Maven
>= 2.0.0, < 2.4.02.4.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-80
Also known as
CVE-2024-46910

More atlas advisories

All atlas
High 7.1May 4Apache Atlas has a Code Injection VulnerabilityCVE-2026-40563fixed in 2.5.0High 8.8Dec 14, 2022Apache Atlas: zip path traversal in import functionalityCVE-2022-34271fixed in 2.3.0Medium 6.1Feb 10, 2022Cross-site scripting in Apache AtlasCVE-2020-13928fixed in 2.1.0Medium 6.1Jan 8, 2020Stored XSS in Apache AtlasCVE-2019-10070fixed in 0.8.4 +1High 7.5Aug 29, 2017Apache Atlas versions 0.6.0CVE-2016-8752no fix yetMedium 6.1Aug 29, 2017Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookiesCVE-2017-3150no fix yet