High severity · published Feb 13, 2025
CVE-2024-46910
Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user
7.1
CVSS
0.6%
EPSS
No
On KEV
Description
An authenticated user can perform XSS and potentially impersonate another user.
This issue affects Apache Atlas versions 2.3.0 and earlier.
Users are recommended to upgrade to version 2.4.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache Atlas · Apache Software Foundation
2.0.0 through 2.3.0 · source: vendor
AT
Atlas · Apache
2.0.0 before 2.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46910
Issue Tracking
https://lists.apache.org/thread/sqzp34l4cdk21zoq5g31qlsvr7jvb1fy
Mailing List
http://www.openwall.com/lists/oss-security/2025/02/12/2
More from Apache Atlas
8.8
CVE-2026-50622
Apache Atlas: Missing Authorization on Admin Endpoints
8.1
CVE-2026-40563
Apache Atlas: Script injection allows access to unintended data
5.4
CVE-2025-62198
Apache Atlas: Stored XSS in Create Entity page