PT-2019-4252 · Apache · Apache Atlas

Publicado 2019-11-17 · Atualizado 2020-01-08 · CVE-2019-10070

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Atlas versions 0.8.3 and 1.1.0

Description The issue is related to the lack of input data sanitization in the Apache Atlas metadata management system. This can be exploited by a remote attacker to perform cross-site scripting attacks, specifically Stored Cross-Site Scripting in the search functionality.

Recommendations For Apache Atlas version 0.8.3, update to a version that includes input sanitization to prevent cross-site scripting attacks. For Apache Atlas version 1.1.0, apply the necessary patches or configuration changes to ensure proper input data cleaning in the search functionality. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-04853

CVE-2019-10070

GHSA-V62J-FCXQ-J239

Produtos afetados

Apache Atlas

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10070 · Nota de Segurança
• https://lists.apache.org/thread.html/cc21437c4c5053a13e13332d614d5172f39da03491fe17ae260be221@%3Cdev.atlas.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-v62j-fcxq-j239 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10070 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04853 · Nota de Segurança
• https://lists.apache.org/thread.html/cc21437c4c5053a13e13332d614d5172f39da03491fe17ae260be221%40%3Cdev.atlas.apache.org%3E · Nota