Vulnerabilidades do Apache Software Foundation Atlas
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Apache Software Foundation Atlas: 3 registro(s), com versões afetadas e correções.cpe:2.3:a:apache:atlas
CVE-2025-62198
Média · 5.4
CWE-80 22/06/2026
Apache Atlas: Stored XSS in Create Entity page
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
CVE-2026-40563
Alta · 8.1
CWE-94 04/05/2026
Apache Atlas: Script injection allows access to unintended data
Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
CVE-2020-17521
Média · 5.5
07/12/2020
Apache Groovy provides extension methods to aid with creating temporary directories…
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.