Cross-site Scripting in Apache Atlas

Description

References

• nvd.nist.gov/vuln/detail/CVE-2017-3155 · ADVISORY
• apache/atlas · PACKAGE
• pypa/advisory-database · WEB
• lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea%40%3Cdev.atlas.apache.org%3E · WEB
• lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea@%3Cdev.atlas.apache.org%3E · WEB
• web.archive.org/web/20200227151159/http://www.securityfocus.com/bid/100587 · WEB
• securityfocus.com/bid/100587

Mais vulnerabilidades de org.apache.atlas:atlas-common

• CVE-2017-3154ALTO 7.5Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
• CVE-2017-3153MÉDIO 6.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.
• CVE-2017-3152MÉDIO 6.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.
• CVE-2017-3151MÉDIO 6.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionali…
• CVE-2017-3150MÉDIO 6.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.