CVE-2020-15824
published 2020-08-08CVE-2020-15824: In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation…
PriorityP350high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.83%
76.4th percentile
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | kotlin | — | — |
| jetbrains | kotlin | — | — |
| oracle | banking_extensibility_workbench | — | — |
| oracle | banking_extensibility_workbench | — | — |
| oracle | banking_extensibility_workbench | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
ghsa8.8HIGH
osv8.8HIGH
vendor_debian8.8LOW
vendor_oracle8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
TemporaryFolder on unix-like systems does not limit access to created files
osv·2022-11-23
CVE-2022-41946 [MEDIUM] TemporaryFolder on unix-like systems does not limit access to created files
TemporaryFolder on unix-like systems does not limit access to created files
**Vulnerability**
`PreparedStatement.setText(int, InputStream)`
and
`PreparedStatemet.setBytea(int, InputStream)`
will create a temporary file if the InputStream is larger than 51k
Example of vulnerable code:
```java
String s = "some very large string greater than 51200 bytes";
PreparedStatement.setInputStream(1, new ByteArrayInputStream(s.getBytes()) );
```
This will create a temporary file which is readable by other users on Unix like systems, but not MacOS.
Impact
On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.
GHSA
TemporaryFolder on unix-like systems does not limit access to created files
ghsa·2022-11-23
CVE-2022-41946 [MEDIUM] CWE-200 TemporaryFolder on unix-like systems does not limit access to created files
TemporaryFolder on unix-like systems does not limit access to created files
**Vulnerability**
`PreparedStatement.setText(int, InputStream)`
and
`PreparedStatemet.setBytea(int, InputStream)`
will create a temporary file if the InputStream is larger than 51k
Example of vulnerable code:
```java
String s = "some very large string greater than 51200 bytes";
PreparedStatement.setInputStream(1, new ByteArrayInputStream(s.getBytes()) );
```
This will create a temporary file which is readable by other users on Unix like systems, but not MacOS.
Impact
On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.
GHSA
GHSA-vhcp-vwq7-69fw: In JetBrains Kotlin before 1
ghsa_unreviewed·2022-05-24
CVE-2020-15824 [MEDIUM] CWE-269 GHSA-vhcp-vwq7-69fw: In JetBrains Kotlin before 1
In JetBrains Kotlin before 1.4.0, there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
OSV
Local information disclosure via system temporary directory
osv·2021-04-23·CVSS 8.8
CVE-2021-28168 [HIGH] Local information disclosure via system temporary directory
Local information disclosure via system temporary directory
## Impact
Eclipse Jersey 2.28 - 2.33 and Eclipse Jersey 3.0.0 - 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the `File.createTempFile` which creates a file inside of the system temporary directory with the permissions: `-rw-r--r--`. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
## Workaround
This issue can be mitigated by manually setting the `java.io.tmpdir` system property when launching the JVM.
## Patches
Jersey 2.34 and 3.0.2 forward sets the correct permissions on the temporary file created by Jersey.
### References
- https://github.com/ecli
GHSA
Local information disclosure via system temporary directory
ghsa·2021-04-23·CVSS 8.8
CVE-2021-28168 [HIGH] CWE-378 Local information disclosure via system temporary directory
Local information disclosure via system temporary directory
## Impact
Eclipse Jersey 2.28 - 2.33 and Eclipse Jersey 3.0.0 - 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the `File.createTempFile` which creates a file inside of the system temporary directory with the permissions: `-rw-r--r--`. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
## Workaround
This issue can be mitigated by manually setting the `java.io.tmpdir` system property when launching the JVM.
## Patches
Jersey 2.34 and 3.0.2 forward sets the correct permissions on the temporary file created by Jersey.
### References
- https://github.com/ecli
GHSA
Local Information Disclosure Vulnerability in Netty on Unix-Like systems
ghsa·2021-02-08
CVE-2021-21290 [MEDIUM] CWE-378 Local Information Disclosure Vulnerability in Netty on Unix-Like systems
Local Information Disclosure Vulnerability in Netty on Unix-Like systems
### Impact
When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.
The CVSSv3.1 score of this vulnerability is calculated to be a [6.2/10](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1)
### Vulnerability Details
On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.
The method `File.createTempFile` on unix-like systems
OSV
Local Information Disclosure Vulnerability in Netty on Unix-Like systems
osv·2021-02-08
CVE-2021-21290 [MEDIUM] Local Information Disclosure Vulnerability in Netty on Unix-Like systems
Local Information Disclosure Vulnerability in Netty on Unix-Like systems
### Impact
When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.
The CVSSv3.1 score of this vulnerability is calculated to be a [6.2/10](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1)
### Vulnerability Details
On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.
The method `File.createTempFile` on unix-like systems
OSV
Local Temp Directory Hijacking Vulnerability
osv·2020-11-04
CVE-2020-27216 [HIGH] Local Temp Directory Hijacking Vulnerability
Local Temp Directory Hijacking Vulnerability
### Impact
On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
Additionally, any user code uses of [WebAppContext::getTempDirectory](https://www.eclipse.org/jetty/javadoc/9.4.31.v20200723/org/eclipse/jetty/webapp/WebAppCon
GHSA
Local Temp Directory Hijacking Vulnerability
ghsa·2020-11-04
CVE-2020-27216 [HIGH] CWE-378 Local Temp Directory Hijacking Vulnerability
Local Temp Directory Hijacking Vulnerability
### Impact
On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
Additionally, any user code uses of [WebAppContext::getTempDirectory](https://www.eclipse.org/jetty/javadoc/9.4.31.v20200723/org/eclipse/jetty/webapp/WebAppCon
OSV
TemporaryFolder on unix-like systems does not limit access to created files
osv·2020-10-12
CVE-2020-15250 [MEDIUM] TemporaryFolder on unix-like systems does not limit access to created files
TemporaryFolder on unix-like systems does not limit access to created files
### Vulnerability
The JUnit4 test rule [TemporaryFolder](https://junit.org/junit4/javadoc/4.13/org/junit/rules/TemporaryFolder.html) contains a local information disclosure vulnerability.
Example of vulnerable code:
```java
public static class HasTempFolder {
@Rule
public TemporaryFolder folder = new TemporaryFolder();
@Test
public void testUsingTempFolder() throws IOException {
folder.getRoot(); // Previous file permissions: `drwxr-xr-x`; After fix:`drwx------`
File createdFile= folder.newFile("myfile.txt"); // unchanged/irrelevant file permissions
File createdFolder= folder.newFolder("subfolder"); // unchanged/irrelevant file permissions
// ...
}
}
```
### Impact
On Unix like systems, the system's temporary
GHSA
TemporaryFolder on unix-like systems does not limit access to created files
ghsa·2020-10-12
CVE-2020-15250 [MEDIUM] CWE-200 TemporaryFolder on unix-like systems does not limit access to created files
TemporaryFolder on unix-like systems does not limit access to created files
### Vulnerability
The JUnit4 test rule [TemporaryFolder](https://junit.org/junit4/javadoc/4.13/org/junit/rules/TemporaryFolder.html) contains a local information disclosure vulnerability.
Example of vulnerable code:
```java
public static class HasTempFolder {
@Rule
public TemporaryFolder folder = new TemporaryFolder();
@Test
public void testUsingTempFolder() throws IOException {
folder.getRoot(); // Previous file permissions: `drwxr-xr-x`; After fix:`drwx------`
File createdFile= folder.newFile("myfile.txt"); // unchanged/irrelevant file permissions
File createdFolder= folder.newFolder("subfolder"); // unchanged/irrelevant file permissions
// ...
}
}
```
### Impact
On Unix like systems, the system's temporary
OSV
CVE-2020-15824: In JetBrains Kotlin from 1
osv·2020-08-08·CVSS 8.8
CVE-2020-15824 [HIGH] CVE-2020-15824: In JetBrains Kotlin from 1
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
Oracle
Oracle Oracle Communications Risk Matrix: Policy (Kotlin) — CVE-2020-15824
vendor_oracle·2022-01-15·CVSS 8.8
CVE-2020-15824 [HIGH] Oracle Oracle Communications Risk Matrix: Policy (Kotlin) — CVE-2020-15824
Oracle Oracle Communications Risk Matrix: Policy (Kotlin) vulnerability
CVE: CVE-2020-15824
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Web UI (Kotlin) — CVE-2020-15824
vendor_oracle·2021-10-15·CVSS 8.8
CVE-2020-15824 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Web UI (Kotlin) — CVE-2020-15824
Oracle Oracle Financial Services Applications Risk Matrix: Web UI (Kotlin) vulnerability
CVE: CVE-2020-15824
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Red Hat
kotlin: kotlin-main-kts cached scripts in the system temp directory could result in priviledge escalation
vendor_redhat·2020-08-06·CVSS 8.8
CVE-2020-15824 [HIGH] CWE-269 kotlin: kotlin-main-kts cached scripts in the system temp directory could result in priviledge escalation
kotlin: kotlin-main-kts cached scripts in the system temp directory could result in priviledge escalation
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
A flaw was found in JetBrains kotlin. A script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts is possible in the system temporary directory, which is shared by all users by default. The highest threat from this vulnerabiility is to data confidentiality and integrity as well as system availability.
Statement: CodeReady Studio 12 is not affected by this flaw because it ships a
Debian
CVE-2020-15824: kotlin - In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by t...
vendor_debian·2020·CVSS 8.8
CVE-2020-15824 [HIGH] CVE-2020-15824: kotlin - In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by t...
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
Scope: local
bookworm: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2020/12/06/1https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3Ehttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://www.openwall.com/lists/oss-security/2020/12/06/1https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3Ehttps://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3Ehttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2020-08-08
Published