Cross-site Scripting in Apache Atlas

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2017-3152 · ADVISORY
• apache/atlas · PACKAGE
• pypa/advisory-database · WEB
• lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea%40%3Cdev.atlas.apache.org%3E · WEB
• lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea@%3Cdev.atlas.apache.org%3E · WEB
• web.archive.org/web/20200227151159/http://www.securityfocus.com/bid/100547 · WEB
• securityfocus.com/bid/100577

org.apache.atlas:atlas-common のその他の脆弱性

• CVE-2017-3155中 6.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.
• CVE-2017-3154高 7.5Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
• CVE-2017-3153中 6.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.
• CVE-2017-3151中 6.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionali…
• CVE-2017-3150中 6.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.