Path Traversal in Apache Atlas

Also known as GHSA-m2rr-h6g4-9cm9, PYSEC-2017-105

Published 9 y ago 2017-08-29 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.1%

percentile 82%

Public exploits

none known

Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.

Exploit prediction (EPSS)

2.13% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`
OSV	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
GitHub	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.atlas:atlas-common`	>=0.6.0-incubating, <0.8-incubating	0.8-incubating
pypi	`apache-atlas`	all versions	no fix listed

Affected products

Apache Software Foundation Apache Atlas

Classification

Weakness

CWE-284 Improper Access Control
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

lists.apache.org /thread.html/f7435d66b840daa2a38ad1329d639b70f5a9476e7580ae885d422e86%40%3Cdev.atlas.apach · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-8752 · advisory
github.com /apache/atlas · package
github.com /pypa/advisory-database/tree/main/vulns/apache-atlas/PYSEC-2017-105.yaml · web
lists.apache.org /thread.html/f7435d66b840daa2a38ad1329d639b70f5a9476e7580ae885d422e86@%3Cdev.atlas.apache. · web

Sources

CVE List: CVE-2016-8752
GitHub Advisory: GHSA-m2rr-h6g4-9cm9
NVD: CVE-2016-8752
OSV: PYSEC-2017-105

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary