CVE-2020-17521

Published: Dec 7, 2020Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Affected (39)

Products: Apache: Groovy, Atlas · Netapp: Snapcenter · Oracle: Agile Engineering Data Management, Agile Plm, Agile Plm Mcad Connector, Business Process Management Suite, Communications Brm Elastic Charging Engine, Communications Diameter Signaling Router, Communications Evolved Communications Application Server, Communications Services Gatekeeper, Healthcare Data Repository, Hospitality Opera 5, Ilearning, Insurance Policy Administration, Jd Edwards Enterpriseone Orchestrator, Primavera Gateway, Primavera Unifier, Retail Bulk Data Integration, Retail Merchandising System, Retail Store Inventory Management

2 products

1 product

18 products

Agile Engineering Data Management

Agile Plm

Agile Plm Mcad Connector

Business Process Management Suite

Communications Brm Elastic Charging Engine

Communications Diameter Signaling Router

Communications Evolved Communications Application Server

Communications Services Gatekeeper

Healthcare Data Repository

Hospitality Opera 5

Ilearning

Insurance Policy Administration

Jd Edwards Enterpriseone Orchestrator

Primavera Gateway

Primavera Unifier

Retail Bulk Data Integration

Retail Merchandising System

Retail Store Inventory Management

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Groovy	From 2.0.0 to 2.4.20
Apache Groovy	From 2.5.0 to 2.5.13
Apache Groovy	From 3.0.0 to 3.0.6
Apache Groovy	Version 4.0.0 alpha1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Snapcenter	All versions

Configuration C

33 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Engineering Data Management	Version 6.2.1.0
Oracle Agile Plm	Version 9.3.3
Oracle Agile Plm	Version 9.3.6
Oracle Agile Plm Mcad Connector	Version 3.4
Oracle Agile Plm Mcad Connector	Version 3.6
Oracle Business Process Management Suite	Version 12.2.1.3.0
Oracle Business Process Management Suite	Version 12.2.1.4.0
Oracle Communications Brm Elastic Charging Engine	Version 11.3.0.9.0
Oracle Communications Brm Elastic Charging Engine	Version 12.0.0.3
Oracle Communications Diameter Signaling Router	Version 8.4.0.0
Oracle Communications Evolved Communications Application Server	Version 7.1
Oracle Communications Services Gatekeeper	Version 6.0
Oracle Communications Services Gatekeeper	Version 6.1
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Healthcare Data Repository	Version 7.0.2
Oracle Hospitality Opera 5	Version 5.6
Oracle Ilearning	Version 6.2
Oracle Ilearning	Version 6.3
Oracle Insurance Policy Administration	From 11.0 to 11.3.1
Oracle Jd Edwards Enterpriseone Orchestrator	Version 9.2.6.0
Oracle Primavera Gateway	From 17.12.0 to 17.12.10
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 16.1
Oracle Primavera Unifier	Version 16.2
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Primavera Unifier	Version 20.12
Oracle Retail Bulk Data Integration	Version 15.0.3.0
Oracle Retail Bulk Data Integration	Version 16.0.3.0
Oracle Retail Merchandising System	Version 16.0.3
Oracle Retail Store Inventory Management	Version 14.1.3.10
Oracle Retail Store Inventory Management	Version 15.0.3.5
Oracle Retail Store Inventory Management	Version 16.0.3.5