CVE-2024-46910

CVE-2024-46910 is a cross-site scripting (XSS) vulnerability, classified under CWE-80, that allows an authenticated user to inject malicious scripts and potentially impersonate another user. The issue affects Apache Atlas versions 2.3.0 and earlier. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), indicating high severity due to network accessibility, low attack complexity, and significant integrity impact.

An attacker with low-privilege authenticated access (PR:L) can exploit this vulnerability over the network without requiring user interaction. Successful exploitation enables the execution of arbitrary scripts in the context of other users' browsers, leading to potential account impersonation, session hijacking, or theft of sensitive data viewed by victims, with low confidentiality impact but high integrity compromise.

Apache advisories recommend upgrading to Apache Atlas version 2.4.0, which remediates the vulnerability. Details are available in the official Apache announcement on their mailing list and the oss-security mailing list.