Apache Atlas Cross-Site Scripting Vulnerability Allowing User Impersonation

A cross-site scripting (XSS) vulnerability has been identified in Apache Atlas, allowing an authenticated user to perform XSS attacks and potentially impersonate another user. This issue affects Apache Atlas versions 2.0.0 through 2.3.0. The vulnerability arises from insufficient input sanitization, which could be exploited to inject malicious scripts that are executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an authenticated user can inject malicious scripts that are executed in the context of another user.

Remediation

Users are advised to upgrade to Apache Atlas version 2.4.0, which addresses this vulnerability. For those unable to upgrade, merging the commit related to DOMPurify could be a potential workaround.