CVE-2017-3150: Apache Atlas - Accessible Cookies
Summary
CVE-2017-3150: Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script. Affects apache-atlas versions 0.0.1 – 0.0.5. No fix is published. How to fix ↓
Also tracked for
- org.apache.atlas:atlas-common · Maven
The same CVE-2017-3150 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Atlas is an open-source software project that provides scalable metadata management and governance capabilities for organizations. It is primarily used in the context of data lakes and data governance. The vulnerability in question affects Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating. These versions utilize cookies that can be accessed by client-side scripts.
Vulnerability Detail
The vulnerability (CVE-2017-3150) in Apache Atlas allows client-side scripts to access cookies used by the application. This can lead to potential security risks, as sensitive information stored in cookies may be exposed to unauthorized parties. An attacker could exploit this vulnerability to gain access to user session data or perform other malicious actions. The vulnerability has a CVSSv3 score of 6.1, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to a patched version is the recommended solution.
Conclusion
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating are vulnerable to a security issue that allows client-side scripts to access cookies. This can potentially lead to unauthorized access to sensitive information. Users should upgrade to Apache Atlas version 0.8.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-atlas →
FAQ
Apache Atlas is an open-source software project that provides metadata management and governance capabilities for organizations, particularly in the context of data lakes and data governance.
The vulnerability affects Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating.
The vulnerability allows client-side scripts to access cookies used by Apache Atlas, potentially exposing sensitive information and enabling unauthorized access to user session data.
To fix this vulnerability, it is recommended to upgrade to Apache Atlas version 0.8.0 or later, as the developers have addressed this issue in subsequent releases.
No specific workaround is provided for this vulnerability. Upgrading to a patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-atlas.
