01 Record

CVE-2020-15824

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 1.88% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 79.1% of scored records. A rank, not a probability.
NVD base score: 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2020-08-08 20:21Z6 YR AGO

Last updated

2024-08-04 13:30Z2 YR AGO

Reserved

2020-07-19

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-269Improper Privilege ManagementClass

Data version

5.1

Document digest

83632bb5feb5bcdbd81805d921f1eed319fb032aa9e8b85dc55352c346840af7

05 Affected products

VendorProductVersionsPlatforms

jetbrainskotlinNot specified—

oraclebanking_extensibility_workbenchNot specified—

oraclecommunications_cloud_native_core_policyNot specified—

redhatintegrationNot specified—

redhatjboss_fuseNot specified—

06 References

lists.apache.org[groovy-users] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosurehttps://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[groovy-dev] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosurehttps://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3Emailing-listx_refsource_MLIST
www.openwall.com[oss-security] 20201206 [CVE-2020-17521]: Apache Groovy Information Disclosurehttp://www.openwall.com/lists/oss-security/2020/12/06/1mailing-listx_refsource_MLIST
lists.apache.org[announce] 20201205 [SECURITY] CVE-2020-17521: Apache Groovy Information Disclosurehttps://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosurehttps://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3Emailing-listx_refsource_MLIST
www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
blog.jetbrains.comhttps://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/x_refsource_MISC
www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC