CVE-2020-17521Apache Groovy provides extension methods to aid with creating temporary directories.
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache Groovy and 21 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 1.03%, higher than 63% of scored CVEs.
Do this next
Free account, 1 product
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 1.03% (percentile 63)
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache Groovy apache_software_foundation:apache_groovy (from the name) | 2.0 to 2.4.20; 2.5.0 to 2.5.13; 3.0.0 to 3.0.6; 4.0.0-alpha-1 | CNA record |
apache groovy apache:groovy | from 2.0.0 through 2.4.20; from 2.5.0 through 2.5.13; from 3.0.0 through 3.0.6; 4.0.0 | NVD |
netapp snapcenter netapp:snapcenter | all versions | NVD |
oracle agile_engineering_data_management oracle:agile_engineering_data_management | 6.2.1.0 | NVD |
oracle agile_plm_mcad_connector oracle:agile_plm_mcad_connector | 3.4; 3.6 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.3; 9.3.6 | NVD |
oracle business_process_management_suite oracle:business_process_management_suite | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle communications_brm_-_elastic_charging_engine oracle:communications_brm_-_elastic_charging_engine | 11.3.0.9.0; 12.0.0.3 | NVD |
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router | 8.4.0.0 | NVD |
oracle communications_evolved_communications_application_server oracle:communications_evolved_communications_application_server | 7.1 | NVD |
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper | 6.0; 6.1; 7.0 | NVD |
oracle healthcare_data_repository oracle:healthcare_data_repository | 7.0.2 | NVD |
oracle hospitality_opera_5 oracle:hospitality_opera_5 | 5.6 | NVD |
oracle ilearning oracle:ilearning | 6.2; 6.3 | NVD |
oracle insurance_policy_administration oracle:insurance_policy_administration | from 11.0 through 11.3.1 | NVD |
oracle jd_edwards_enterpriseone_orchestrator oracle:jd_edwards_enterpriseone_orchestrator | 9.2.6.0 | NVD |
oracle primavera_gateway oracle:primavera_gateway | from 17.12.0 through 17.12.10 | NVD |
oracle primavera_unifier oracle:primavera_unifier | from 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12; 20.12 | NVD |
oracle retail_bulk_data_integration oracle:retail_bulk_data_integration | 15.0.3.0; 16.0.3.0 | NVD |
oracle retail_merchandising_system oracle:retail_merchandising_system | 16.0.3 | NVD |
oracle retail_store_inventory_management oracle:retail_store_inventory_management | 14.1.3.10; 15.0.3.5; 16.0.3.5 | NVD |
apache atlas apache:atlas | 2.1.0 | NVD |
References
- https://groovy-lang.org/security.html#CVE-2020-17521x-refsource-confirm, third-party-advisory
- https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpujan2021.htmlx-refsource-misc, patch, third-party-advisory
- https://security.netapp.com/advisory/ntap-20201218-0006/x-refsource-confirm, third-party-advisory
- https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpuApr2021.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlx-refsource-misc, patch, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.