CVE-2024-46910
Published: 13 February 2025
Summary
CVE-2024-46910 is a high-severity Basic XSS (CWE-80) vulnerability in Apache Atlas. Its CVSS base score is 7.1 (High).
Operationally, ranked in the top 36.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates user inputs to block malicious script injection that enables XSS exploitation in Apache Atlas.
Filters outputs to encode or escape scripts, preventing their execution in other users' browsers and mitigating impersonation.
Mandates timely patching and upgrading of vulnerable software like Apache Atlas to version 2.4.0, directly remediating the XSS flaw.
NVD Description
An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recommended to upgrade to version 2.4.0, which fixes the issue.
Deeper analysisAI
CVE-2024-46910 is a cross-site scripting (XSS) vulnerability, classified under CWE-80, that allows an authenticated user to inject malicious scripts and potentially impersonate another user. The issue affects Apache Atlas versions 2.3.0 and earlier. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), indicating high severity due to network accessibility, low attack complexity, and significant integrity impact.
An attacker with low-privilege authenticated access (PR:L) can exploit this vulnerability over the network without requiring user interaction. Successful exploitation enables the execution of arbitrary scripts in the context of other users' browsers, leading to potential account impersonation, session hijacking, or theft of sensitive data viewed by victims, with low confidentiality impact but high integrity compromise.
Apache advisories recommend upgrading to Apache Atlas version 2.4.0, which remediates the vulnerability. Details are available in the official Apache announcement on their mailing list and the oss-security mailing list.
Details
- CWE(s)