Apache Atlas: zip path traversal in import functionality

ALTO 8.8CVE-2022-34271 · GHSA-p782-4j23-xqcg · Published 14/12/2022 · updated 17/06/2026

En resumen

CVE-2022-34271 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a org.apache.atlas:apache-atlas, atlas (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.5%, mayor que el 73.9% de las vulnerabilidades.
Solución: actualizar a 2.3.0 o posterior.

Package	Affected versions	Patched versions
org.apache.atlas:apache-atlas Maven	`≥ 0.8.4, < 2.3.0`	`2.3.0`
atlas apache	`≥ 0.8.4, ≤ 2.2.0`	No fix yet

Description

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

NVD description

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

References

nvd.nist.gov/vuln/detail/CVE-2022-34271 · ADVISORY
apache/atlas commit 3415913 · WEB
apache/atlas · PACKAGE
issues.apache.org/jira/browse/ATLAS-4622 · WEB
lists.apache.org/thread/0rqvcxo6brmos9w3lzfsdn2lsmlblpw3 · WEB

Más vulnerabilidades de org.apache.atlas:apache-atlas

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.atlas:apache-atlas

Maven

≥ 0.8.4, < 2.3.0

2.3.0

atlas

apache

≥ 0.8.4, ≤ 2.2.0

No fix yet

Description

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

NVD description

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.

Más vulnerabilidades de org.apache.atlas:apache-atlas

Ver todo →