CVE-2024-46910

Published: Feb 13, 2025Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Exploitability: 2.8 / Impact: 4.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recommended to upgrade to version 2.4.0, which fixes the issue.

Affected (1)

Products: Apache: Atlas

Apache

1 product

Atlas

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Atlas	From 2.0.0 to 2.4.0

Related CWEs

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References (2)

https://lists.apache.org/thread/sqzp34l4cdk21zoq5g31qlsvr7jvb1fy

Source: security@apache.org

Issue TrackingMailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2025/02/12/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.