Skip to content
Advisories.
atlasPYSEC-2017-108

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.

Medium6.1CVE-2017-3152 · Published Aug 29, 2017 · updated Oct 9, 2025

Source advisory

Affected versions

PackageAffectedFixed in
apache-atlas
PyPI
all versionsNo fix yet
Details and references

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.

CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
the CVSS score
Also known as
CVE-2017-3152, GHSA-9xwq-72vp-5j3c

More atlas advisories

All
DateAdvisory
Aug 292017Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
CVE-2016-8752High7.5no fix yet
Aug 292017Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.
CVE-2017-3150Medium6.1no fix yet
Aug 292017Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.
CVE-2017-3151Medium6.1no fix yet
Aug 292017Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.
CVE-2017-3153Medium6.1no fix yet
Aug 292017Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
CVE-2017-3154High7.5no fix yet
Aug 292017Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.
CVE-2017-3155Medium6.1no fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.