CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2020-29582
Medium (5.3). EPSS 2.6% chance of exploitation in the next 30 days. Fixed in org.jetbrains.kotlin:kotlin-stdlib 1.4.21.
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
Severity
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-276
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jetbrains:kotlin
- oracle:communications_cloud_native_core_network_slice_selection_function
- oracle:communications_cloud_native_core_policy
- oracle:communications_cloud_native_core_service_communication_proxy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cqj8-47ch-rvvq | Maven | org.jetbrains.kotlin:kotlin-stdlib | <1.4.21 | 1.4.21 |
References
- https://blog.jetbrains.com
- https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html