CVE-2020-29582: jetbrains kotlin Incorrect Default Permissions
CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2020-29582DEBIAN-CVE-2020-29582CGA-25q6-cp2g-mrcjCGA-4c8m-vmg5-j8p5CGA-4mpq-53wf-wcrvCGA-4w8m-m2fq-9h2xCGA-63h5-5mcx-5h3rCGA-7gp3-2qh9-gqfgCGA-89f5-vvp4-79j3CGA-96j3-m3vp-x9ffCGA-g7qr-89jm-c8gfCGA-vhm6-qjf2-3fxrCGA-22hp-jm33-f999CGA-2542-7q27-jvpcCGA-2cxx-rp9m-3j6pCGA-2m52-m346-5v27CGA-39gj-3c94-phxwCGA-3gjh-xfg7-696rCGA-46fv-944v-p3w6CGA-47p8-3rv7-r9j7CGA-496j-9cwq-67g6CGA-5f3w-22h7-cv79CGA-5gc9-8h5j-gp9xCGA-5qj3-6wjh-mc36CGA-78pv-3cvf-qg36CGA-7g6g-cqc2-h258CGA-83w6-858q-mw53CGA-9crj-m6g7-38ppCGA-9x2c-69pf-mj7fCGA-h5xp-qfh4-9m7qCGA-p3fr-939g-w78jCGA-pfh5-xmvm-98cvGHSA-cqj8-47ch-rvvqCGA-q9v3-cr75-jvv4CGA-r437-gm66-rjvwCGA-vfr7-42rx-h7h9CGA-w2c4-32fq-8h4h
Published 03-02-2021Last modified 04-08-2024
Vulnerability summary
CVE-2020-29582 is a medium (CVSS 5.3) Incorrect Default Permissions vulnerability in jetbrains kotlin. EPSS estimates a 2.57% chance of exploitation in the next 30 days, higher than 84.9% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
2.57%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 03-02-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
CVSS metrics
7 scores · 6 sources · 2 versionsMedium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
2.57%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.57% on 18-09-2026
18-09-202618-10-2026
EPSS score2.57%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- eco-java-gradle-3.0All versions (No fix recorded)
- eco-java-gradle-3.1All versions (No fix recorded)
- eco-java-gradle-3.2All versions (No fix recorded)
- eco-java-gradle-3.2.1All versions (No fix recorded)
- eco-java-gradle-3.3All versions (No fix recorded)
Wolfi5 products
- thingsboard< 3.7-r1
- thingsboard-tb-js-executor< 3.7-r1
- thingsboard-tb-mqtt-transport< 3.7-r1
- thingsboard-tb-node< 3.7-r1
- thingsboard-tb-web-ui< 3.7-r1
Oracle3 products
Debian1 product
- kotlinAll versions (No fix recorded) | < 1.3.31+ds1-3
Jetbrains1 product
- kotlin< 2.1.0
Org.jetbrains.kotlin1 product
- kotlin-stdlib< 1.4.21
Ubuntu1 product
- kotlinAll versions (No fix recorded)
7 vendors · 29 products
References
13 links- blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/X Refsource MISCAdvisoryVendor Advisory
