High severity · published Feb 13, 2025
CVE-2024-46910
An authenticated user can perform XSS and potentially impersonate another user
7.1
CVSS
0.6%
EPSS
No
On KEV
Description
An authenticated user can perform XSS and potentially impersonate another user.
This issue affects Apache Atlas versions 2.3.0 and earlier.
Users are recommended to upgrade to version 2.4.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Atlas · Apache
2.0.0 before 2.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46910
Issue Tracking
https://lists.apache.org/thread/sqzp34l4cdk21zoq5g31qlsvr7jvb1fy
Mailing List
http://www.openwall.com/lists/oss-security/2025/02/12/2
More from Atlas
8.8
CVE-2026-50622
Apache Atlas: Missing Authorization on Admin Endpoints
8.8
CVE-2022-34271
A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem
8.1
CVE-2026-40563
Apache Atlas: Script injection allows access to unintended data
7.5
CVE-2017-3154
Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information
7.5
CVE-2016-8752
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img