CVE-2025-62198

MediumCVSS 5.4/10Last modified Oct 6, 2026

Description

An authenticated user can perform XSS.

This issue affects Apache Atlas versions 2.4.0 and earlier.

Users are recommended to upgrade to version 2.5.0, which fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

VendorProductVersions
Apache Software FoundationApache Atlas<= 2.4.0

References

Timeline

Published
Jun 22, 2026
Last modified
Oct 6, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-621997.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-62207.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CVE-2025-622007.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622017.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622027.1Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2025-622037.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622048.0Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-622057.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-622066.5Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to discloCVE-2025-622079.8Azure Monitor Elevation of Privilege VulnerabilityCVE-2025-622085.5Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.CVE-2025-622095.5Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.
CVE-2025-62198: Medium severity, CVSS 5.4 | Vulnix