CVE-2025-62198 json
Apache Atlas: Stored XSS in Create Entity page
published 4mo ago modified last mo. also GHSA-v73p-f52r-fmmr , EUVD-2025-210296
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
Patch / fix
- maven org.apache.atlas:atlas-dashboardv2 2.5.0
- apache atlas 2.5.0
Is CVE-2025-62198 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.atlas:atlas-dashboardv2 | <2.5.0 |
2.5.0 |
Affected products
- Apache Software Foundation Apache Atlas
Classification
- Weakness
-
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
References
-
github.com
/apache/atlas/commit/800f979307d6ea0f0b6563ec890f6b728022e497
web
-
lists.apache.org
/thread/nv893lhz3ok08f25j3v4z1to5nrpdp7k
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2026/06/20/1
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-62198
advisory
-
github.com
/apache/atlas
package
Sources
- CVE List CVE-2025-62198
- GitHub Advisory GHSA-v73p-f52r-fmmr
- NVD CVE-2025-62198
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.