CVE-2016-8752: Apache Atlas Directory Traversal Vulnerability
Summary
CVE-2016-8752: Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img. Affects apache-atlas versions 0.0.1 – 0.0.5. No fix is published. How to fix ↓
Also tracked for
- org.apache.atlas:atlas-common · Maven
The same CVE-2016-8752 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Atlas is an open-source metadata management and governance framework for Apache Hadoop. It provides a scalable and extensible solution for managing metadata and lineage information for big data applications. The vulnerability in Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allows unauthorized access to the webapp directory contents by pointing to URIs like /js and /img.
Vulnerability Detail
The vulnerability, identified as CVE-2016-8752, is a directory traversal vulnerability that allows an attacker to access the contents of the webapp directory. By manipulating the URI, an attacker can bypass access controls and retrieve sensitive information or potentially execute arbitrary code. This vulnerability poses a high risk as it can lead to unauthorized access, data leakage, and potential compromise of the entire Apache Atlas installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the webapp directory by configuring the web server or application firewall to block requests to URIs like /js and /img. This can be achieved by adding specific rules or filters to the server configuration or firewall settings. However, this workaround may impact the functionality of legitimate requests to the webapp directory, so upgrading to a patched version is strongly recommended.
Conclusion
The directory traversal vulnerability in Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allows unauthorized access to the webapp directory, posing a high risk of data leakage and potential compromise. Users are advised to upgrade to a patched version of Apache Atlas and implement proper access controls to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-atlas →
FAQ
Apache Atlas is an open-source metadata management and governance framework for Apache Hadoop. It provides a scalable and extensible solution for managing metadata and lineage information for big data applications.
The vulnerability affects Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating).
This vulnerability allows unauthorized access to the webapp directory, potentially leading to data leakage, unauthorized information retrieval, and potential compromise of the entire Apache Atlas installation.
To fix this vulnerability, it is recommended to upgrade to a patched version of Apache Atlas (0.6.2, 0.7.2, or later). Additionally, ensure proper access controls and security configurations are in place.
As a temporary workaround, users can restrict access to the webapp directory by configuring the web server or application firewall to block requests to URIs like /js and /img. However, upgrading to a patched version is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-atlas.
