CVE-2025-62198
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier.
Risk Assessment
XSS attacks can lead to session hijacking or the injection of malicious code, posing a threat to application and data security.
Recommendation
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
Other vulnerabilities in Apache Atlas
See all- CVE-2026-40563High
Apache Atlas has a code injection vulnerability that allows an attacker to alter Gremlin traversal logic by supplying malicious query strings. This can lead to unauthorized access to data.
- CVE-2017-3154High
Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
- CVE-2016-8752High
Apache Atlas versions 0.6.0, 0.7.0, and 0.7.1 allow access to the webapp directory contents by pointing to URIs like /js and /img.
- CVE-2026-50622High
In Apache Atlas, missing authorization in admin endpoints allows any authenticated user, regardless of role, to perform administrative operations.
Original NVD description (English source)
An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which fixes the issue.