CVE-2020-17521

Low

No strong exploitation signal.

CVSS base

5.5 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — probability of exploitation (30 days)

1.1%

63.1th percentile

CISA KEV

Not listed

Weakness / dates

—

Published 2020-12-07 · modified 2026-08-25

CVSS breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector	L	Local
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	N	None
Availability	N	None

Timeline

2020-12-07 — Published (NVD)
2026-08-25 — Last modified (NVD)

Description

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Affected

apache netapp oracle

References

Official: NVD · CVE.org