{"id":"CVE-2020-29582","aliases":["DEBIAN-CVE-2020-29582","EUVD-2022-3613","GHSA-cqj8-47ch-rvvq","UBUNTU-CVE-2020-29582"],"status":"published","title":"Incorrect Default Permissions in JetBrains Kotlin","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02604,"percentile":0.85501,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2021-02-03T15:20:28Z","modified":"2026-10-26T12:02:49Z","fixes":[{"ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-stdlib","fixed_in":["1.4.21"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"kotlin","fixed_in":["1.3.31+ds1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kotlin","fixed_in":["1.3.31+ds1-3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.20"},{"fixed":"1.4.21"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-1","1.3.31+ds1-2","1.3.31+ds1-3","1.3.31+ds1-4","1.3.31+ds1-5","1.3.31+ds1-6","1.3.31+ds1-7"]},{"source":"osv","ecosystem":"Debian:13","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.31+ds1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.31+ds1-3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21"}]}],"versions":["0.0.1-test-deploy","0.0.2-test-deploy","0.10.1316","0.10.195","0.10.4","0.10.709","0.10.770","0.11.91","0.11.91.1","0.11.91.2","0.11.91.4","0.12.1218","0.12.1230","0.12.200","0.12.213","0.12.412","0.12.613","0.13.1513","0.13.1514","0.13.1516","0.14.449","0.14.451","0.5.1131","0.5.998","0.6.1070","0.6.1315","0.6.1411","0.6.1507","0.6.1590","0.6.1603","0.6.1617","0.6.1658","0.6.1670","0.6.1673","0.6.179","0.6.1910","0.6.22","0.6.2451","0.6.2517","0.6.31","0.6.317","0.6.350","0.6.594","0.6.602","0.6.69","0.6.786","0.6.800","0.6.912","0.7.1090","0.7.115","0.7.1217","0.7.191","0.7.258","0.7.270","0.7.271","0.7.5","0.7.802","0.7.852","0.7.86","0.7.895","0.8.11","0.8.1527","0.8.484","0.8.679","0.9.0-native","0.9.1-native","0.9.206","0.9.66","0.9.976","1.0.0","1.0.0-beta-1038","1.0.0-beta-1103","1.0.0-beta-2417","1.0.0-beta-2422","1.0.0-beta-2423","1.0.0-beta-3593","1.0.0-beta-3594","1.0.0-beta-3595","1.0.0-beta-4583","1.0.0-beta-4584","1.0.0-beta-4589","1.0.0-rc-1036","1.0.1","1.0.1-1","1.0.1-2","1.0.2","1.0.2-1","1.0.3","1.0.4","1.0.5","1.0.5-2","1.0.5-3","1.0.6","1.0.7","1.1.0","1.1.1","1.1.2","1.1.2-2","1.1.2-3","1.1.2-4","1.1.2-5","1.1.3","1.1.3-2","1.1.4","1.1.4-2","1.1.4-3","1.1.50","1.1.51","1.1.60","1.1.61","1.2.0","1.2.10","1.2.20","1.2.21","1.2.30","1.2.31","1.2.40","1.2.41","1.2.50","1.2.51","1.2.60","1.2.61","1.2.70","1.2.71","1.3.0","1.3.0-rc-190","1.3.0-rc-198","1.3.10","1.3.11","1.3.20","1.3.21","1.3.30","1.3.31","1.3.40","1.3.41","1.3.50","1.3.60","1.3.61","1.3.70","1.3.71","1.3.72","1.4.0","1.4.0-rc","1.4.10","1.4.20","1.4.20-M1","1.4.20-M2","1.4.20-RC"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+~1.0.1+~0.11.12-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-1build5","1.3.31+ds1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-2","1.3.31+ds1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-3ubuntu1","1.3.31+ds1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-3","1.3.31+ds1-3ubuntu1"]}],"products":[{"vendor":"jetbrains","product":"kotlin"},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy"}],"references":[{"url":"https://blog.jetbrains.com","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29582","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cqj8-47ch-rvvq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-29582","tags":["advisory"]},{"url":"https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-29582","tags":["report"]},{"url":"https://youtrack.jetbrains.com/issue/KT-42181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-29582","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-29582","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","status":"published","published":"2021-02-03T15:20:28Z","modified":"2024-08-04T16:55:10.292Z","updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2022-3613","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","status":"published","published":"2021-02-03T15:20:28Z","modified":"2024-08-04T16:55:10Z","updated_at":"2026-11-03T03:07:06.885366Z"}],"ghsa":[{"id":"GHSA-cqj8-47ch-rvvq","title":"Incorrect Default Permissions in JetBrains Kotlin","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","status":"published","published":"2022-05-24T17:40:48Z","modified":"2023-01-27T05:02:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2020-29582","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","status":"published","published":"2021-02-03T16:15:13.727Z","modified":"2026-06-17T03:11:28.82Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:06:34.188486Z"}],"osv":[{"id":"CVE-2020-29582","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","status":"published","published":"2021-02-03T16:15:13.727Z","modified":"2026-10-24T10:30:25.423026822Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-29582","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","status":"published","published":"2021-02-03T16:15:13.727Z","modified":"2026-10-26T12:02:49.488885954Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-cqj8-47ch-rvvq","title":"Incorrect Default Permissions in JetBrains Kotlin","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","status":"published","published":"2022-05-24T17:40:48Z","modified":"2026-09-10T03:49:38.478412191Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2020-29582","description":"In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.","status":"published","published":"2021-02-03T16:15:00Z","modified":"2026-10-17T12:56:55.40630727Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:24.541803Z"}]}}