GCVE - cpe:2.3:a:apache:atlas:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:atlas:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Atlas (`2096eb9a-8aba-5a90-a302-8db1fd1f6f5d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:apache/atlas`	purl2cpe	2026-06-01 10:14:29.655901
`pkg:github/apache/atlas`	purl2cpe	2026-06-01 10:14:29.655904
`pkg:maven/org.apache.atlas/apache-atlas`	purl2cpe	2026-06-01 10:14:29.655907
`pkg:maven/org.apache.atlas/apache.atlas`	purl2cpe	2026-06-01 10:14:29.655910

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-40563`	vulnerable	2026-06-08 08:01:20.842457	Apache Atlas: Script injection allows access to unintended data Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect Version: This issue affects Apache Atlas: from 0.8 through 2.4.0. For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration. atlas.dsl.executor.traversal=false Mitigation: Users are recommended to upgrade to version 2.5.0, which fixes the issue. Published: 2026-05-04T15:17:32.511Z Updated: 2026-05-06T13:27:03.304Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-46910`	vulnerable	2026-06-08 06:48:10.827480	Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recommended to upgrade to version 2.4.0, which fixes the issue. Published: 2025-02-13T08:52:57.498Z Updated: 2025-10-17T15:50:34.064Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/sqzp34l4cdk21zoq5g31qlsvr7jvb1fy	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-34271`	vulnerable	2026-06-08 05:44:52.525347	Apache Atlas: zip path traversal in import functionality A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0. Published: 2022-12-14T08:35:59.499Z Updated: 2025-04-18T14:28:47.874Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/0rqvcxo6brmos9w3lzfsdn2lsmlblpw3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-13928`	vulnerable	2026-06-08 05:18:01.388292	Details available Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability. Published: 2020-09-16T17:38:38.000Z Updated: 2024-08-04T12:32:14.230Z Open on db.gcve.eu Reference links https://lists.apache.org/thread.html/ra468036f913be41b0c8fea74f91d53e273b0bfa838a4b140a5dcd463%40%3Cuser.atlas.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-10070`	vulnerable	2026-06-08 05:12:22.097515	Details available Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality Published: 2019-11-18T20:05:31.000Z Updated: 2024-08-04T22:10:09.252Z Open on db.gcve.eu Reference links https://lists.apache.org/thread.html/cc21437c4c5053a13e13332d614d5172f39da03491fe17ae260be221%40%3Cdev.atlas.apache.org%3E	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.