CVE-2019-10070: Stored XSS in Apache Atlas
Summary
CVE-2019-10070: Stored XSS in Apache Atlas. Affects org.apache.atlas:apache-atlas across 2 version ranges.
< 0.8.4
>= 1.0.0, < 1.2.0
Fixed in 0.8.4 or 1.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Atlas is an open-source metadata management and governance framework for data lakes. It provides a scalable and extensible solution for capturing, managing, and governing metadata about data assets. The vulnerability affects Apache Atlas versions 0.8.3 and 1.1.0.
Vulnerability Detail
The vulnerability in Apache Atlas is a Stored Cross-Site Scripting (XSS) issue that exists in the search functionality. An attacker can exploit this vulnerability by injecting malicious scripts into the search input, which will be stored and executed when the search results are displayed. This can lead to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 2.5.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.8.40.8.4 -
>= 1.0.0, < 1.2.01.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the provided fix by upgrading to the patched versions of Apache Atlas.
Conclusion
Apache Atlas versions 0.8.3 and 1.1.0 are vulnerable to Stored XSS in the search functionality. Users should upgrade to version 0.8.4 or 1.2.0 to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.atlas:apache-atlas →
FAQ
Apache Atlas is an open-source metadata management and governance framework for data lakes.
Versions 0.8.3 and 1.1.0 of Apache Atlas are affected.
The vulnerability allows for Stored Cross-Site Scripting (XSS) attacks, which can lead to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, upgrade to Apache Atlas version 0.8.4 if using version 0.8.3, or upgrade to version 1.2.0 if using version 1.1.0.
No, there is no known workaround. It is recommended to apply the provided fix by upgrading to the patched versions of Apache Atlas.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.atlas:apache-atlas.
