PT-2025-6693 · Apache · Apache Atlas

Darpan Patel · Published 2025-02-12 · Updated 2025-07-14 · CVE-2024-46910

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Atlas versions 2.3.0 and earlier

Description An authenticated user can perform XSS and potentially impersonate another user. This issue allows for cross-site scripting attacks, which could lead to unauthorized actions being taken on behalf of other users.

Recommendations For Apache Atlas versions 2.3.0 and earlier, upgrade to version 2.4.0, which fixes the issue. As a temporary workaround, consider restricting access to sensitive features that could be exploited through XSS attacks until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2024-46910

GHSA-X3V6-F5FR-4WWV

Affected Products

Apache Atlas

References · 18

• https://osv.dev/vulnerability/CVE-2024-46910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46910 · Security Note
• https://lists.apache.org/thread/sqzp34l4cdk21zoq5g31qlsvr7jvb1fy · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3v6-f5fr-4wwv · Vendor Advisory
• https://github.com/apache/atlas · Note
• https://t.me/pentestingnews/56550 · Telegram Post
• https://t.me/cvedetector/17991 · Telegram Post
• http://openwall.com/lists/oss-security/2025/02/12/2 · Note
• https://t.me/cvenotify/128830 · Telegram Post
• https://twitter.com/TMJIntel/status/1890391794883461489 · Twitter Post
• https://twitter.com/samilaiho/status/1890366497052037610 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1890337295334625665 · Twitter Post
• https://twitter.com/CVEnew/status/1890046643719790930 · Twitter Post
• https://twitter.com/fridaysecurity/status/1890214579759902846 · Twitter Post
• https://twitter.com/oss_security/status/1889752279613350165 · Twitter Post