CVE-2020-17521
Information Disclosure in Apache Groovy
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
5.5
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- Record
CVE-2020-17521- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- Record
CVE-2020-17521- Updated
- 2026-11-02
EUVDEUVD-2020-1505 No score
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- Record
EUVD-2020-1505- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rcjj-h6gh-jf3r
5.5
Information Disclosure in Apache Groovy
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- Record
GHSA-rcjj-h6gh-jf3r- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-379
- Updated
- 2026-11-02
OSV
5.5
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- Record
CVE-2020-17521- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-17521
5.5
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- Record
DEBIAN-CVE-2020-17521- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-rcjj-h6gh-jf3r
5.5
Information Disclosure in Apache Groovy
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- Record
GHSA-rcjj-h6gh-jf3r- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-379
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-17521
5.5
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
- Record
UBUNTU-CVE-2020-17521- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:2367-1 No score
Security update for groovy
This update for groovy fixes the following issues:
- groovy was updated to 2.4.21
- CVE-2020-17521: Fixed an information disclosure vulnerability (bsc#1179729).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2020:2367-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10823-1 No score
groovy-2.4.21-2.3 on GA media
These are all security issues fixed in the groovy-2.4.21-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10823-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3917-1 No score
Security update for groovy
This update for groovy fixes the following issues:
- groovy was updated to 2.4.21
- CVE-2020-17521: Fixed an information disclosure vulnerability (bsc#1179729).
- Record
SUSE-SU-2020:3917-1- Updated
- 2026-11-02
Affected products
- apache groovy
- apache atlas
- apache software foundation groovy
- netapp snapcenter
- oracle agile engineering data management
- oracle agile plm mcad connector
- oracle agile product lifecycle management
- oracle business process management suite
- oracle communications brm - elastic charging engine
- oracle communications diameter signaling router
- oracle communications evolved communications application server
- oracle communications services gatekeeper
Show 10 moreShow less
- oracle healthcare data repository
- oracle hospitality opera 5
- oracle ilearning
- oracle insurance policy administration
- oracle jd edwards enterpriseone orchestrator
- oracle primavera gateway
- oracle primavera unifier
- oracle retail bulk data integration
- oracle retail merchandising system
- oracle retail store inventory management
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.codehaus.groovy:groovyMaven |
2.0.0 up to 2.4.21 | 2.4.21 |
org.codehaus.groovy:groovyMaven |
2.5.0 up to 2.5.14 | 2.5.14 |
org.codehaus.groovy:groovyMaven |
3.0.0 up to 3.0.7 | 3.0.7 |
org.codehaus.groovy:groovy-allMaven |
2.0.0 up to 2.4.21 | 2.4.21 |
org.codehaus.groovy:groovy-allMaven |
2.5.0 up to 2.5.14 | 2.5.14 |
org.codehaus.groovy:groovy-allMaven |
3.0.0 up to 3.0.7 | 3.0.7 |
groovyDebian:12 |
before 2.4.21-1 | 2.4.21-1 |
groovyDebian:13 |
before 2.4.21-1 | 2.4.21-1 |
groovyDebian:14 |
before 2.4.21-1 | 2.4.21-1 |
org.codehaus.groovy:groovyMaven |
2.0.0 up to 2.4.21, plus listed versions 2.0.12.0.22.0.32.0.42.0.5 Show 45 moreShow less2.0.62.0.72.0.82.1.02.1.0-beta-12.1.0-rc-12.1.0-rc-22.1.0-rc-32.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0-beta-12.2.0-beta-22.2.0-rc-12.2.0-rc-22.2.0-rc-32.2.12.2.22.3.02.3.0-beta-12.3.0-beta-22.3.0-rc-12.3.0-rc-22.3.0-rc-42.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0-beta-12.4.0-beta-2 |
2.4.21 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.codehaus.groovy:groovyMaven |
2.5.0 up to 2.5.14, plus listed versions 2.5.12.5.102.5.112.5.122.5.13 Show 8 moreShow less2.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.9 |
2.5.14 |
org.codehaus.groovy:groovyMaven |
3.0.0 up to 3.0.7, plus listed versions 3.0.13.0.23.0.33.0.43.0.53.0.6 |
3.0.7 |
org.codehaus.groovy:groovy-allMaven |
2.0.0 up to 2.4.21, plus listed versions 2.0.12.0.22.0.32.0.42.0.5 Show 45 moreShow less2.0.62.0.72.0.82.1.02.1.0-beta-12.1.0-rc-12.1.0-rc-22.1.0-rc-32.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0-beta-12.2.0-beta-22.2.0-rc-12.2.0-rc-22.2.0-rc-32.2.12.2.22.3.02.3.0-beta-12.3.0-beta-22.3.0-rc-12.3.0-rc-22.3.0-rc-42.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0-beta-12.4.0-beta-2 |
2.4.21 |
org.codehaus.groovy:groovy-allMaven |
2.5.0 up to 2.5.14, plus listed versions 2.5.12.5.102.5.112.5.122.5.13 Show 8 moreShow less2.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.9 |
2.5.14 |
org.codehaus.groovy:groovy-allMaven |
3.0.0 up to 3.0.7, plus listed versions 3.0.13.0.23.0.33.0.43.0.53.0.6 |
3.0.7 |
groovySUSE:Linux Enterprise Module for Development Tools 15 SP2 |
before 2.4.21-3.3.2 | 2.4.21-3.3.2 |
groovyUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.0~beta2+isreally1.8.6-4ubuntu1 |
None known |
groovy2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.4.3+dfsg-2ubuntu12.4.3+dfsg-32.4.5-12.4.5-1ubuntu0.1~esm1 |
None known |
groovyUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.8-22.4.8-32.4.14-12.4.15-1ubuntu12.4.16-1ubuntu1~18.04.1 |
None known |
groovyUbuntu:20.04:LTS |
All versions, plus listed versions 2.4.16-2ubuntu12.4.17-4ubuntu1 |
None known |
groovyUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.21-1 |
None known |
groovyUbuntu:24.04:LTS |
All versions, plus listed versions 2.4.21-82.4.21-92.4.21-10 |
None known |
groovyUbuntu:25.10 |
All versions, plus listed versions 2.4.21-10 |
None known |
groovyUbuntu:26.10 |
All versions, plus listed versions 2.4.21-10build1 |
None known |
groovyUbuntu:26.04:LTS |
All versions, plus listed versions 2.4.21-102.4.21-10build1 |
None known |
groovyopenSUSE:Leap 15.2 |
before 2.4.21-lp152.2.3.2 | 2.4.21-lp152.2.3.2 |
groovyopenSUSE:Tumbleweed |
before 2.4.21-2.3 | 2.4.21-2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-17521 is a medium vulnerability (CVSS 5.5) in Apache Groovy, published December 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in org.codehaus.groovy:groovy 2.4.21.
References
groovy-lang.org/security.html
lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E
oracle.com/security-alerts/cpujan2021.html
security.netapp.com/advisory/ntap-20201218-0006
lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E
lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E
Show 24 moreShow less
oracle.com/security-alerts/cpuApr2021.html
oracle.com//security-alerts/cpujul2021.html
oracle.com/security-alerts/cpuoct2021.html
oracle.com/security-alerts/cpujan2022.html
oracle.com/security-alerts/cpuapr2022.html
oracle.com/security-alerts/cpujul2022.html
nvd.nist.gov/vuln/detail/CVE-2020-17521
github.com/apache/groovy/pull/1425
github.com/apache/groovy/commit/bcbe5c4c76db83736166530647c024ac1e47ef28
lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3E
lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08@%3Cdev.atlas.apache.org%3E
lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3@%3Cdev.atlas.apache.org%3E
github.com/advisories/GHSA-rcjj-h6gh-jf3r
security-tracker.debian.org/tracker/CVE-2020-17521
github.com/apache/groovy
suse.com/support/update/announcement/2020/suse-su-20203917-1
bugzilla.suse.com/1179729
suse.com/security/cve/CVE-2020-17521
ubuntu.com/security/CVE-2020-17521
issues.apache.org/jira/browse/GROOVY-9824
openwall.com/lists/oss-security/2020/12/06/1
github.com/apache/groovy/commit/4e418d4a34c973a7ec1e822552103043ac13780e
cve.org/CVERecord?id=CVE-2020-17521
lists.opensuse.org/archives/list/[email protected]/thread/VYXXLFFWNBEOWRTRF6VZBDCDBSGYTI4L
Left out here: 49 versions. The JSON record has them.