CVE-2025-62198CWE-80

CVE-2025-62198

Medium · published June 22, 2026

CVSS v3.1
5.4
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

An authenticated user can perform XSS.

This issue affects Apache Atlas versions 2.4.0 and earlier.

Users are recommended to upgrade to version 2.5.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00505 · 42.3th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-06-22T12:16Z
Affected products (1)
ProductVersionsFixed in
apache/atlas< 2.5.02.5.0
References (2)
https://lists.apache.org/thread/nv893lhz3ok08f25j3v4z1to5nrpdp7k · [email protected]http://www.openwall.com/lists/oss-security/2026/06/20/1 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 22 JUN 07:47Z
    Apache Atlas: Stored XSS in Create Entity page
    cvelistv5