CVE-2020-29582: In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation

Medium severity · published Feb 3, 2021

CVE-2020-29582

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation

5.3

CVSS

2.6%

EPSS

On KEV

Description

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.6% · higher than 85% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Communications Cloud Native Core Network Slice Selection Function · Oracle

1.2.1 · source: NVD

Communications Cloud Native Core Policy · Oracle

1.14.0 · source: NVD

Communications Cloud Native Core Service Communication Proxy · Oracle

1.14.0 · source: NVD

Kotlin · Jetbrains

before 2.1.0 · source: NVD

Affected product

Kotlin

Jetbrains

All Kotlin CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-29582

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-29582

Vendor Advisory

https://blog.jetbrains.com

Vendor Advisory

https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/

Third Party Advisory

https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E

Patch

https://www.oracle.com//security-alerts/cpujul2021.html

Patch

https://www.oracle.com/security-alerts/cpuapr2022.html

Patch

https://www.oracle.com/security-alerts/cpujan2022.html