CVE-2022-34271— Apache Atlas: zip path traversal in import functionality
Quick assessment
Affected
Apache Software Foundation Apache Atlas
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Atlas是美国阿帕奇（Apache）基金会的一套可伸缩和可扩展的核心功能治理服务。 Apache Atlas 0.8.4 到 2.2.0 版本存在路径遍历漏洞，该漏洞源于导入模块中的漏洞允许经过身份验证的用户写入 Web 服务器文件系统 。
Possible ATT&CK Techniques 1 AI
T1222.001 · Windows Permissions
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-34271
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Atlas: zip path traversal in import functionality
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Atlas 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Atlas是美国阿帕奇（Apache）基金会的一套可伸缩和可扩展的核心功能治理服务。 Apache Atlas 0.8.4 到 2.2.0 版本存在路径遍历漏洞，该漏洞源于导入模块中的漏洞允许经过身份验证的用户写入 Web 服务器文件系统 。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Atlas | 0.8.4 ~ 2.3.0 | - |
|
II. Public POCs for CVE-2022-34271
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-34271
请登录查看更多情报信息。
Mailing List Discussions for CVE-2022-34271 (1)
-
https://lists.apache.org/thread/0rqvcxo6brmos9w3lzfsdn2lsmlblpw3 vendor-advisory
IV. Related Vulnerabilities
Same product: Apache Atlas
-
CVE-2026-50622
Apache Atlas: Missing Authorization on Admin Endpoints -
CVE-2025-62198
Apache Atlas: Stored XSS in Create Entity page -
CVE-2026-40563
Apache Atlas: Script injection allows access to unintended d -
CVE-2024-46910
Apache Atlas: An authenticated user can perform XSS and pote -
CVE-2020-13928
Apache Atlas 跨站脚本漏洞
Same vendor: Apache Software Foundation
-
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion -
CVE-2026-93546
Apache HTTP Server: mod_dav_fs namespace overflow -
CVE-2026-79768
Apache HTTP Server: mod_userdir information disclosure -
CVE-2026-73637
Apache HTTP Server: mod_auth_digest DoS attack -
CVE-2026-73636
Apache HTTP Server: mod_auth_digest one-time-nonce replay at
Same weakness: CWE-22
-
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-101889
Prime Mover < 2.2.1 Path Traversal via wprime-config.json -
CVE-2026-101888
Prime Mover < 2.2.1 Zip Slip Path Traversal File Write -
CVE-2026-94620
Classroom 50 vulnerable to arbitrary file overwrite on the t -
CVE-2026-95588
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbi
V. Comments for CVE-2022-34271
No comments yet