CVE-2020-15824

 

Published at: - 08-08-2020 11:15

Last modified: - 03-03-2022 06:45

Total changes: - 5

Description

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
• [groovy-users] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure-Mailing List, Third Party Advisory
• [groovy-dev] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure-Mailing List, Third Party Advisory
• [oss-security] 20201206 [CVE-2020-17521]: Apache Groovy Information Disclosure-Mailing List, Third Party Advisory
• [announce] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosure-Mailing List, Third Party Advisory
• [groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure-Mailing List, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html

 

Keywords

NVD

 

CVE-2020-15824

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures