GHSA-rcjj-h6gh-jf3r · Severity: medium · Ecosystem: maven — Information Disclosure in Apache Groovy
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Conclusion & alert: CVE-2020-17521 is rated Moderate Risk (41.5/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.05%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 2.43% | 1.05% | -1.38% |
| 2 | 2026-03-21 | 1.79% | 2.43% | +0.64% |
| 3 | 2026-03-04 | — | 1.79% | — |
Full EPSS history (27 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.5 | 3.1 | MEDIUM |
|
1.8 | 3.6 | [email protected] |
| 2.1 | 2.0 | LOW |
|
3.9 | 2.9 | [email protected] |
GHSA-rcjj-h6gh-jf3r · Severity: medium · Ecosystem: maven — Information Disclosure in Apache Groovy
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2020-17521 not yet assigned priority: Debian including 1 source packages (groovy), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2020-17521 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2020-17521 |
suse
|
medium | CVE-2020-17521 severity moderate: SUSE including 57 source package names (groovy-2.4.21-2.3, groovy-2.4.21-3.3.2, …), 134 product×package rows across 13 product lines (SUSE Linux Enterprise Module for Development Tools 15 SP2, SUSE Linux Enterprise Module for Development Tools 15 SP3, … (13 product lines)): Fixed 134. | https://www.suse.com/security/cve/CVE-2020-17521/ |
ubuntu
|
low | CVE-2020-17521 low priority: Ubuntu including 2 source packages (groovy, groovy2), 32 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 15, ignored 8, needs-triage 7, needed 1, released 1. | https://ubuntu.com/security/CVE-2020-17521 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | groovy | >= 2.0.0, <= 2.4.20 | cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:* |
| apache | groovy | >= 2.5.0, <= 2.5.13 | cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:* |
| apache | groovy | >= 3.0.0, <= 3.0.6 | cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:* |
| apache | groovy | 4.0.0 | cpe:2.3:a:apache:groovy:4.0.0:alpha1:*:*:*:*:*:* |
| netapp | snapcenter | — | cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |
| oracle | agile_engineering_data_management | 6.2.1.0 | cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* |
| oracle | agile_plm | 9.3.3 | cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:* |
| oracle | agile_plm | 9.3.6 | cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:* |
| oracle | agile_plm_mcad_connector | 3.4 | cpe:2.3:a:oracle:agile_plm_mcad_connector:3.4:*:*:*:*:*:*:* |
| oracle | agile_plm_mcad_connector | 3.6 | cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:* |
| oracle | business_process_management_suite | 12.2.1.3.0 | cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | business_process_management_suite | 12.2.1.4.0 | cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | communications_brm_-_elastic_charging_engine | 11.3.0.9.0 | cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:* |
| oracle | communications_brm_-_elastic_charging_engine | 12.0.0.3 | cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:* |
| oracle | communications_diameter_signaling_router | 8.4.0.0 | cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4.0.0:*:*:*:*:*:*:* |
| oracle | communications_evolved_communications_application_server | 7.1 | cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:* |
| oracle | communications_services_gatekeeper | 6.0 | cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:* |
| oracle | communications_services_gatekeeper | 6.1 | cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:* |
| oracle | communications_services_gatekeeper | 7.0 | cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* |
| oracle | healthcare_data_repository | 7.0.2 | cpe:2.3:a:oracle:healthcare_data_repository:7.0.2:*:*:*:*:*:*:* |
| oracle | hospitality_opera_5 | 5.6 | cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:* |
| oracle | ilearning | 6.2 | cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:* |
| oracle | ilearning | 6.3 | cpe:2.3:a:oracle:ilearning:6.3:*:*:*:*:*:*:* |
| oracle | insurance_policy_administration | >= 11.0, <= 11.3.1 | cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* |
| oracle | jd_edwards_enterpriseone_orchestrator | 9.2.6.0 | cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.6.0:*:*:*:*:*:*:* |
| oracle | primavera_gateway | >= 17.12.0, <= 17.12.10 | cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* |
| oracle | primavera_unifier | >= 17.7, <= 17.12 | cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* |
| oracle | primavera_unifier | 16.1 | cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* |
| oracle | primavera_unifier | 16.2 | cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* |
| oracle | primavera_unifier | 18.8 | cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* |
| oracle | primavera_unifier | 19.12 | cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* |
| oracle | primavera_unifier | 20.12 | cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* |
| oracle | retail_bulk_data_integration | 15.0.3.0 | cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:* |
| oracle | retail_bulk_data_integration | 16.0.3.0 | cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* |
| oracle | retail_merchandising_system | 16.0.3 | cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* |
| oracle | retail_store_inventory_management | 14.1.3.10 | cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.10:*:*:*:*:*:*:* |
| oracle | retail_store_inventory_management | 15.0.3.5 | cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.5:*:*:*:*:*:*:* |
| oracle | retail_store_inventory_management | 16.0.3.5 | cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.5:*:*:*:*:*:*:* |
| apache | atlas | 2.1.0 | cpe:2.3:a:apache:atlas:2.1.0:-:*:*:*:*:*:* |