Every CVE Search/ Get API key

CVE-2020-17521

Information Disclosure in Apache Groovy

5.5 MediumFix available

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.03%Down 2.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Record
CVE-2020-17521
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Updated
2026-11-02
CVE List No score

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Record
CVE-2020-17521
Updated
2026-11-02
EUVDEUVD-2020-1505 No score

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Record
EUVD-2020-1505
Updated
2026-11-02
GitHub AdvisoriesGHSA-rcjj-h6gh-jf3r 5.5

Information Disclosure in Apache Groovy

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Record
GHSA-rcjj-h6gh-jf3r
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-379
Updated
2026-11-02
OSV 5.5

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Record
CVE-2020-17521
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-17521 5.5

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Record
DEBIAN-CVE-2020-17521
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-rcjj-h6gh-jf3r 5.5

Information Disclosure in Apache Groovy

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Record
GHSA-rcjj-h6gh-jf3r
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-379
Updated
2026-11-02
OSVUBUNTU-CVE-2020-17521 5.5

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Record
UBUNTU-CVE-2020-17521
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2020:2367-1 No score

Security update for groovy

This update for groovy fixes the following issues:

  • groovy was updated to 2.4.21
  • CVE-2020-17521: Fixed an information disclosure vulnerability (bsc#1179729).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2020:2367-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10823-1 No score

groovy-2.4.21-2.3 on GA media

These are all security issues fixed in the groovy-2.4.21-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10823-1
Updated
2026-11-02
OSVSUSE-SU-2020:3917-1 No score

Security update for groovy

This update for groovy fixes the following issues:

  • groovy was updated to 2.4.21
  • CVE-2020-17521: Fixed an information disclosure vulnerability (bsc#1179729).
Record
SUSE-SU-2020:3917-1
Updated
2026-11-02

Affected products

Show 10 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
org.codehaus.groovy:groovy
Maven
2.0.0 up to 2.4.21
2.4.21
org.codehaus.groovy:groovy
Maven
2.5.0 up to 2.5.14
2.5.14
org.codehaus.groovy:groovy
Maven
3.0.0 up to 3.0.7
3.0.7
org.codehaus.groovy:groovy-all
Maven
2.0.0 up to 2.4.21
2.4.21
org.codehaus.groovy:groovy-all
Maven
2.5.0 up to 2.5.14
2.5.14
org.codehaus.groovy:groovy-all
Maven
3.0.0 up to 3.0.7
3.0.7
groovy
Debian:12
before 2.4.21-1
2.4.21-1
groovy
Debian:13
before 2.4.21-1
2.4.21-1
groovy
Debian:14
before 2.4.21-1
2.4.21-1
org.codehaus.groovy:groovy
Maven
2.0.0 up to 2.4.21, plus listed versions
2.0.12.0.22.0.32.0.42.0.5
Show 45 moreShow less
2.0.62.0.72.0.82.1.02.1.0-beta-12.1.0-rc-12.1.0-rc-22.1.0-rc-32.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0-beta-12.2.0-beta-22.2.0-rc-12.2.0-rc-22.2.0-rc-32.2.12.2.22.3.02.3.0-beta-12.3.0-beta-22.3.0-rc-12.3.0-rc-22.3.0-rc-42.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0-beta-12.4.0-beta-2
2.4.21
Show 17 moreShow less
Affected packages
PackageAffectedFixed
org.codehaus.groovy:groovy
Maven
2.5.0 up to 2.5.14, plus listed versions
2.5.12.5.102.5.112.5.122.5.13
Show 8 moreShow less
2.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.9
2.5.14
org.codehaus.groovy:groovy
Maven
3.0.0 up to 3.0.7, plus listed versions
3.0.13.0.23.0.33.0.43.0.53.0.6
3.0.7
org.codehaus.groovy:groovy-all
Maven
2.0.0 up to 2.4.21, plus listed versions
2.0.12.0.22.0.32.0.42.0.5
Show 45 moreShow less
2.0.62.0.72.0.82.1.02.1.0-beta-12.1.0-rc-12.1.0-rc-22.1.0-rc-32.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0-beta-12.2.0-beta-22.2.0-rc-12.2.0-rc-22.2.0-rc-32.2.12.2.22.3.02.3.0-beta-12.3.0-beta-22.3.0-rc-12.3.0-rc-22.3.0-rc-42.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0-beta-12.4.0-beta-2
2.4.21
org.codehaus.groovy:groovy-all
Maven
2.5.0 up to 2.5.14, plus listed versions
2.5.12.5.102.5.112.5.122.5.13
Show 8 moreShow less
2.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.9
2.5.14
org.codehaus.groovy:groovy-all
Maven
3.0.0 up to 3.0.7, plus listed versions
3.0.13.0.23.0.33.0.43.0.53.0.6
3.0.7
groovy
SUSE:Linux Enterprise Module for Development Tools 15 SP2
before 2.4.21-3.3.2
2.4.21-3.3.2
groovy
Ubuntu:16.04:LTS
All versions, plus listed versions
2.0.0~beta2+isreally1.8.6-4ubuntu1
None known
groovy2
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
2.4.3+dfsg-2ubuntu12.4.3+dfsg-32.4.5-12.4.5-1ubuntu0.1~esm1
None known
groovy
Ubuntu:18.04:LTS
All versions, plus listed versions
2.4.8-22.4.8-32.4.14-12.4.15-1ubuntu12.4.16-1ubuntu1~18.04.1
None known
groovy
Ubuntu:20.04:LTS
All versions, plus listed versions
2.4.16-2ubuntu12.4.17-4ubuntu1
None known
groovy
Ubuntu:22.04:LTS
All versions, plus listed versions
2.4.21-1
None known
groovy
Ubuntu:24.04:LTS
All versions, plus listed versions
2.4.21-82.4.21-92.4.21-10
None known
groovy
Ubuntu:25.10
All versions, plus listed versions
2.4.21-10
None known
groovy
Ubuntu:26.10
All versions, plus listed versions
2.4.21-10build1
None known
groovy
Ubuntu:26.04:LTS
All versions, plus listed versions
2.4.21-102.4.21-10build1
None known
groovy
openSUSE:Leap 15.2
before 2.4.21-lp152.2.3.2
2.4.21-lp152.2.3.2
groovy
openSUSE:Tumbleweed
before 2.4.21-2.3
2.4.21-2.3

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-17521 is a medium vulnerability (CVSS 5.5) in Apache Groovy, published December 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in org.codehaus.groovy:groovy 2.4.21.

References

Show 24 moreShow less
This page doesn't list everything

Left out here: 49 versions. The JSON record has them.

MoveEnter Open