What is the CVSS score of CVE-2025-62198?

CVE-2025-62198 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Atlas are affected by CVE-2025-62198?

Apache Atlas versions 2.4.0 and earlier contain a critical stored cross-site scripting vulnerability that allows authenticated users to inject malicious code affecting other users, including…

How to fix or mitigate CVE-2025-62198?

Within 24 hours: inventory all Apache Atlas deployments and confirm affected versions (2.4.0 and earlier); audit and document all privileged user accounts and recent access patterns. Within 7 days: restrict entity creation permissions to essential personnel only; deploy Web Application Firewall rules or Content Security Policy headers to block inline script execution; enable comprehensive audit logging for all entity creation events. Within 30 days: establish monitoring of Apache Atlas security announcements for patch release; coordinate with vendor support for estimated timeline; prepare and test upgrade procedures for deployment once patches become available.

Apache Atlas CVE-2025-62198

EUVD-2025-210296 MEDIUM

Basic XSS (CWE-80)

2026-06-20

GHSA-v73p-f52r-fmmr

Apache XSS Atlas

5.4

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.4 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-delivered stored XSS requiring low-privilege auth (PR:L), victim browse action (UI:R), with scope change (S:C) affecting the victim's browser session.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 22, 2026 - 18:23 NVD

CRITICAL MEDIUM

CVSS changed

Jun 22, 2026 - 18:23 NVD

5.4 (CRITICAL) 5.4 (MEDIUM)

Analysis Generated

Jun 22, 2026 - 06:14 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Stored XSS in Apache Atlas's Create Entity page allows any authenticated user to inject persistent malicious JavaScript that executes in other users' browsers. All deployments running Apache Atlas 2.4.0 and earlier are affected. An attacker with a valid account can store a crafted payload that triggers against higher-privileged users - such as administrators - who later view the poisoned entity, enabling session hijacking or credential theft. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Apache Atlas is an Apache Software Foundation open-source data governance and metadata management platform widely used in enterprise data lake and Hadoop ecosystems. The Create Entity page allows authenticated users to define metadata entities. The vulnerability arises because user-supplied input submitted during entity creation is stored server-side and later rendered in other users' browsers without adequate output encoding or sanitization - the classic Stored (Persistent) XSS pattern corresponding to CWE-79 (Improper Neutralization of Input During Web Page Generation). No CPE strings were provided in the input data, but the advisory unambiguously identifies Apache Atlas through version 2.4.0 as the affected scope. The issue was discovered by Grzegorz Misiun and disclosed via the oss-security mailing list.

RemediationAI

Vendor-released patch: Apache Atlas 2.5.0. Organizations should upgrade to version 2.5.0, which resolves the stored XSS according to the Apache security advisory at https://atlas.apache.org/ and the oss-security disclosure at https://seclists.org/oss-sec/2026/q2/985. If immediate upgrade is not possible, consider restricting Create Entity privileges to a minimal set of trusted users via Atlas's role-based access control, thereby reducing the population of accounts capable of injecting payloads. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules in front of the Atlas UI can reduce - but not eliminate - the risk, as WAF bypass techniques exist. Content Security Policy (CSP) headers, if not already configured, should be evaluated as a compensating control to limit script execution scope in victims' browsers.