Read the docs
TI-2016-07209 Aliases CVE-2016-8752GHSA-m2rr-h6g4-9cm9

Improper access control in Apache Atlas

Priority LOW 37CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284, CWE-22 and the CVSS impact.

Summary

Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.

Why it matters now

EPSS 0.02127 82nd percentileScored 2026-11-07
Fix Fixed org.apache.atlas:atlas-common (Maven): 0.8-incubating

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Atlas0.6.0-incubating; 0.7.0-incubating; 0.7.1-incubating—No fix listedCNA
—org.apache.atlas:atlas-common (Maven)0.6.0-incubating to before 0.8-incubating0.8-incubatingPatch availableGHSA-m2rr-h6g4-9cm9
  • Apache Atlas VendorApache Affected 0.6.0-incubating; 0.7.0-incubating; 0.7.1-incubating Fixed in — No fix listed CNA
  • org.apache.atlas:atlas-common (Maven) Vendor— Affected 0.6.0-incubating to before 0.8-incubating Fixed in 0.8-incubating Patch available GHSA-m2rr-h6g4-9cm9

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:apache:atlas:0.6.0:*:*:*:*:*:*:*0.6.0VulnerableApache
cpe:2.3:a:apache:atlas:0.6.0:rc1:*:*:*:*:*:*0.6.0 rc1VulnerableApache
cpe:2.3:a:apache:atlas:0.6.0:rc2:*:*:*:*:*:*0.6.0 rc2VulnerableApache
cpe:2.3:a:apache:atlas:0.7.0:*:*:*:*:*:*:*0.7.0VulnerableApache
cpe:2.3:a:apache:atlas:0.7.0:rc1:*:*:*:*:*:*0.7.0 rc1VulnerableApache
cpe:2.3:a:apache:atlas:0.7.0:rc2:*:*:*:*:*:*0.7.0 rc2VulnerableApache
cpe:2.3:a:apache:atlas:0.7.1:*:*:*:*:*:*:*0.7.1VulnerableApache
cpe:2.3:a:apache:atlas:0.7.1:rc1:*:*:*:*:*:*0.7.1 rc1VulnerableApache
cpe:2.3:a:apache:atlas:0.7.1:rc2:*:*:*:*:*:*0.7.1 rc2VulnerableApache
cpe:2.3:a:apache:atlas:0.7.1:rc3:*:*:*:*:*:*0.7.1 rc3VulnerableApache
  • cpe:2.3:a:apache:atlas:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.6.0:rc1:*:*:*:*:*:* Versions 0.6.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.6.0:rc2:*:*:*:*:*:* Versions 0.6.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.7.0:rc1:*:*:*:*:*:* Versions 0.7.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.7.0:rc2:*:*:*:*:*:* Versions 0.7.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.7.1:rc1:*:*:*:*:*:* Versions 0.7.1 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.7.1:rc2:*:*:*:*:*:* Versions 0.7.1 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:atlas:0.7.1:rc3:*:*:*:*:*:* Versions 0.7.1 rc3 Vulnerable ·Apache

Remediation

  • Fix · GHSA-m2rr-h6g4-9cm9 org.apache.atlas:atlas-common (Maven) Fixed in 0.8-incubating Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-8752
  2. 2026-10-03 Alias added: GHSA-m2rr-h6g4-9cm9

References

Advisory 1

Other 4

  • TI-2022-15183 Apache Atlas: zip path traversal in import functionality CVSS 3.1HIGH 8.8
  • TI-2026-37315 Apache Atlas: Missing Authorization on Admin Endpoints CVSS 3.1HIGH 8.8
  • TI-2026-29304 Apache Atlas: Script injection allows access to unintended data CVSS 3.1HIGH 8.1
  • TI-2017-02370 Information disclosure in Apache Atlas CVSS 3.0HIGH 7.5
  • TI-2024-31320 Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user CVSS 3.1HIGH 7.1
  • TI-2020-10906 Cross-site scripting in Apache Atlas CVSS 3.1MEDIUM 6.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences