groovy: OS temporary directory leads to information disclosure

🗓️ 18 Aug 2021 09:13:12Reported by RedHatType

redhat🔗 access.redhat.com👁 11 Views

Groovy's temporary directory creation method can leak sensitive data, compromising confidentiality.

Reporter	Title	Published	Views	Family All 64
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found on thirdparty libraries used by IBM® MobileFirst Platform	26 Jan 202317:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Apache Groovy (groovy-all-2.3.11.jar) have affected APM JBoss and APM WebLogic Agent [CVE-202-17521, CVE-2016-6814, CVE-2015-3253]	3 Jul 202311:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to Apache Groovy	7 Mar 202304:51	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2020-17521 Apache Groovy's provided extension methods to aid with creating temporary directories was using a now superseded Java JDK method call that is potentiallly not secure in some situations.	1 Sep 202120:04	–	ibm
ArchLinux	[ASA-202103-14] groovy: privilege escalation	25 Mar 202100:00	–	archlinux
BDU FSTEC	The vulnerability of the method for creating temporary catalogs in the programming language Apache Groovy, which allows attackers to exploit and disclose protected information	23 Feb 202100:00	–	bdu_fstec
Circl	CVE-2020-17521	7 Dec 202022:30	–	circl
CNNVD	Apache Groovy 安全漏洞	7 Dec 202000:00	–	cnnvd
CNVD	Apache Groovy Provides Resource Management Error Vulnerability	10 Dec 202000:00	–	cnvd
CVE	CVE-2020-17521	7 Dec 202019:22	–	cve

Vulners

Node

AND

redhat integrationRange<1

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2020-17521
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
groovy-lang	www.groovy-lang.org/security.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-17521
cve	www.cve.org/CVERecord

11 Aug 2026 15:13Current

7.1High risk

Vulners AI Score7.1

CVSS 22.1

CVSS 3.15.5

EPSS0.0105

groovy temporary directory information disclosure data confidentiality security flaw unix