Apache Atlas: zip path traversal in import functionality

HOCH 8.8CVE-2022-34271 · GHSA-p782-4j23-xqcg · Published 14/12/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-34271 ist eine Schwachstelle (HOCH (CVSS 8.8)) in org.apache.atlas:apache-atlas, atlas (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 73.9% aller Schwachstellen.
Abhilfe: auf 2.3.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.apache.atlas:apache-atlas Maven	`≥ 0.8.4, < 2.3.0`	`2.3.0`
atlas apache	`≥ 0.8.4, ≤ 2.2.0`	No fix yet

Description

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

NVD description

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

References

nvd.nist.gov/vuln/detail/CVE-2022-34271 · ADVISORY
apache/atlas commit 3415913 · WEB
apache/atlas · PACKAGE
issues.apache.org/jira/browse/ATLAS-4622 · WEB
lists.apache.org/thread/0rqvcxo6brmos9w3lzfsdn2lsmlblpw3 · WEB

Weitere Schwachstellen in org.apache.atlas:apache-atlas

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.atlas:apache-atlas

Maven

≥ 0.8.4, < 2.3.0

2.3.0

atlas

apache

≥ 0.8.4, ≤ 2.2.0

No fix yet

Description

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

NVD description

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

Weitere Schwachstellen in org.apache.atlas:apache-atlas

Alle anzeigen →