CVE-2025-62198
Apache Atlas: Stored XSS in Create Entity page
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Atlas: Stored XSS in Create Entity page
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
- Record
CVE-2025-62198- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-80
- Updated
- 2026-11-02
EUVDEUVD-2025-210296
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
- Record
EUVD-2025-210296- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v73p-f52r-fmmr
Apache Atlas UI: Authenticated User XSS
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
- Record
GHSA-v73p-f52r-fmmr- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-80
- Updated
- 2026-11-02
NVD
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
- Record
CVE-2025-62198- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-80
- Updated
- 2026-11-02
OSV
Apache Atlas: Stored XSS in Create Entity page
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
- Record
CVE-2025-62198- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-80
- Updated
- 2026-11-02
OSVGHSA-v73p-f52r-fmmr
Apache Atlas UI: Authenticated User XSS
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
- Record
GHSA-v73p-f52r-fmmr- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.atlas:atlas-dashboardv2Maven |
before 2.5.0 | 2.5.0 |
org.apache.atlas:atlas-dashboardv2Maven |
before 2.5.0, plus listed versions 0.7-incubating0.7.1-incubating0.8-incubating0.8.10.8.2 Show 11 moreShow less0.8.30.8.41.0.01.0.0-alpha1.1.01.2.02.0.02.1.02.2.02.3.02.4.0 |
2.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-62198 is a medium vulnerability (CVSS 5.4) in Apache Atlas, published June 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in org.apache.atlas:atlas-dashboardv2 2.5.0.
References
lists.apache.org/thread/nv893lhz3ok08f25j3v4z1to5nrpdp7k
openwall.com/lists/oss-security/2026/06/20/1
nvd.nist.gov/vuln/detail/CVE-2025-62198
github.com/apache/atlas/commit/800f979307d6ea0f0b6563ec890f6b728022e497