Vulnerability Description
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jetbrains | Kotlin | < 2.1.0 |
| Oracle | Communications Cloud Native Core Network Slice Selection Function | 1.2.1 |
| Oracle | Communications Cloud Native Core Policy | 1.14.0 |
| Oracle | Communications Cloud Native Core Service Communication Proxy | 1.14.0 |
Related Weaknesses (CWE)
References
- https://blog.jetbrains.comVendor Advisory
- https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/Vendor Advisory
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://blog.jetbrains.comVendor Advisory
- https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/Vendor Advisory
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
FAQ
What is CVE-2020-29582?
CVE-2020-29582 is a vulnerability with a CVSS score of 5.3 (MEDIUM). In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permiss...
How severe is CVE-2020-29582?
CVE-2020-29582 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-29582?
Check the references section above for vendor advisories and patch information. Affected products include: Jetbrains Kotlin, Oracle Communications Cloud Native Core Network Slice Selection Function, Oracle Communications Cloud Native Core Policy, Oracle Communications Cloud Native Core Service Communication Proxy.