CVE-2020-15824

Published: Aug 8, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.

Affected (8)

Products: Jetbrains: Kotlin · Oracle: Banking Extensibility Workbench, Communications Cloud Native Core Policy

1 product

2 products

Banking Extensibility Workbench

Communications Cloud Native Core Policy

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Jetbrains Kotlin	Version 1.4.0 milestone1
Jetbrains Kotlin	Version 1.4.0 milestone2
Jetbrains Kotlin	Version 1.4.0 milestone3
Jetbrains Kotlin	Version 1.4.0 rc

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Extensibility Workbench	Version 14.2
Oracle Banking Extensibility Workbench	Version 14.3
Oracle Banking Extensibility Workbench	Version 14.5
Oracle Communications Cloud Native Core Policy	Version 1.14.0

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (16)

http://www.openwall.com/lists/oss-security/2020/12/06/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/

Source: cve@mitre.org

Vendor Advisory

https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: cve@mitre.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2020/12/06/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.