WaratekVRT Sign in

CVE-2020-17521 Apache Groovy

Affected softwareApache Groovy
Severity5.5 Medium CVSS 3.1 2 scores
Fixed in2.4.21, 2.5.14, 3.0.7
WeaknessCWE-379
Published7 Dec 2020
Updated13 Nov 2026

Description

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.0% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Filesystem.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Filesystem

How to mitigate CVE-2020-17521

Upgrade Apache Groovy to a release that fixes it: 2.4.21, 2.5.14 or 3.0.7. Until you can, Waratek RASP blocks exploitation with its filesystem rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

5.5 MEDIUM v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 2.0 2.1 none AV:L/AC:L/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2026 ↗ CPU 2026-Q2 Oracle Utilities Applications / Security (Apache Groovy) (4.3.0.5.0-4.3.0.6.0, 4.4.0.0.0-4.4.0.3.0)
Oracle Critical Patch Update October 2025 ↗ CPU 2025-Q4 Oracle Systems / Core (Apache Groovy) (4)
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Fusion Middleware / Connectors and Connector Server (Apache Groovy) (11.1.1.5.0, 12.2.1.3.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Fusion Middleware / General (Apache Groovy) (12.2.1.4.0)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle iLearning / Installation (Apache Groovy) (6.3.1)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Groovy) (12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / Runtime Java agent for ODI (Apache Groovy) (12.2.1.3.0, 12.2.1.4.0)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Supply Chain / Installation Issues (Apache Groovy) (6.2.1.0)
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Communications / API Gateway (Apache Groovy) (8.4.0.0)
Oracle Fusion Middleware / BPM Studio (Apache Groovy) (12.2.1.3.0, 12.2.1.4.0)
Oracle Critical Patch Update January 2022 ↗ CPU 2022-Q1 Oracle Supply Chain / CAX Client (Apache Groovy) (3.6, 3.4)
Oracle Critical Patch Update October 2021 ↗ CPU 2021-Q4 Oracle Communications Applications / Orchestration (Apache Groovy) (12.0.0.3)
Oracle Health Sciences Applications / Install Utility (Apache Groovy) (7.0.2)
Oracle Insurance Applications / Architecture (Apache Groovy) (11.0.0 - 11.3.1)
Oracle JD Edwards / E1 IOT Orchestrator (Apache Groovy) (Prior to 9.2.6.0)
Oracle Supply Chain / Security (Apache Groovy) (9.3.3, 9.3.6)
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Communications / Control Engine (Apache Groovy) (7.1)
Oracle Communications Applications / Elastic charging controller (Apache Groovy) (11.3.0.9.0, 12.0.0.3.0)
Oracle Critical Patch Update April 2021 ↗ CPU 2021-Q2 Oracle Communications / PRM (Apache Groovy) (6.0, 6.1, 7.0)
Oracle Construction and Engineering / Admin (Apache Groovy) (17.12.0-17.12.10)
Oracle Construction and Engineering / Platform (Apache Groovy) (16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12)
Oracle Hospitality Applications / Reporting (Apache Groovy) (5.6, 5.6)
Oracle Retail Applications / Foundation (Apache Groovy) (16.0.3)
Oracle Retail Applications / SIM Integration (Apache Groovy) (14.1.3.10, 15.0.3.5, 16.0.3.5)
Oracle iLearning / Installation (Apache Groovy) (6.2, 6.3)
Oracle Critical Patch Update January 2021 ↗ CPU 2021-Q1 Oracle Retail Applications / BDI Job Scheduler (Apache Groovy) (15.0.3, 16.0.3)
Oracle Retail Applications / PeopleSoft Integration Bugs (Apache Groovy) (15.0.3, 16.0.3)
Oracle Retail Applications / RIB Kernal (Apache Groovy) (15.0.3, 16.0.3)
Oracle Retail Applications / RSB kernel (Apache Groovy) (15.0.3, 16.0.3)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications API Gateway (Apache Groovy) 8.4.0.0 8.4.0.0
Oracle Communications Control Engine (Apache Groovy) 7.1 7.1
Oracle Communications PRM (Apache Groovy) 6.0, 6.1, 7.0 6.0 · 6.1 · 7.0
Oracle Communications Applications Elastic charging controller (Apache Groovy) 11.3.0.9.0, 12.0.0.3.0 11.3.0.9.0 · 12.0.0.3.0
Oracle Communications Applications Orchestration (Apache Groovy) 12.0.0.3 12.0.0.3
Oracle Construction and Engineering Admin (Apache Groovy) 17.12.0-17.12.10
Oracle Construction and Engineering Platform (Apache Groovy) 16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12 16.1 · 16.2 · 18.8 · 19.12 · 20.12
Oracle Fusion Middleware BPM Studio (Apache Groovy) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Centralized Thirdparty Jars (Apache Groovy) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Connectors and Connector Server (Apache Groovy) 11.1.1.5.0, 12.2.1.3.0 11.1.1.5.0 · 12.2.1.3.0
Oracle Fusion Middleware General (Apache Groovy) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Runtime Java agent for ODI (Apache Groovy) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Health Sciences Applications Install Utility (Apache Groovy) 7.0.2 7.0.2
Oracle Hospitality Applications Reporting (Apache Groovy) 5.6, 5.6 5.6
Oracle Insurance Applications Architecture (Apache Groovy) 11.0.0 - 11.3.1
Oracle JD Edwards E1 IOT Orchestrator (Apache Groovy) Prior to 9.2.6.0
Oracle Retail Applications BDI Job Scheduler (Apache Groovy) 15.0.3, 16.0.3 15.0.3 · 16.0.3
Oracle Retail Applications Foundation (Apache Groovy) 16.0.3 16.0.3
Oracle Retail Applications PeopleSoft Integration Bugs (Apache Groovy) 15.0.3, 16.0.3 15.0.3 · 16.0.3
Oracle Retail Applications RIB Kernal (Apache Groovy) 15.0.3, 16.0.3 15.0.3 · 16.0.3
Oracle Retail Applications RSB kernel (Apache Groovy) 15.0.3, 16.0.3 15.0.3 · 16.0.3
Oracle Retail Applications SIM Integration (Apache Groovy) 14.1.3.10, 15.0.3.5, 16.0.3.5 14.1.3.10 · 15.0.3.5 · 16.0.3.5
Oracle Supply Chain CAX Client (Apache Groovy) 3.6, 3.4 3.4 · 3.6
Oracle Supply Chain Installation Issues (Apache Groovy) 6.2.1.0 6.2.1.0
Oracle Supply Chain Security (Apache Groovy) 9.3.3, 9.3.6 9.3.3 · 9.3.6
Oracle Systems Core (Apache Groovy) 4 4
Oracle Utilities Applications Security (Apache Groovy) 4.3.0.5.0-4.3.0.6.0, 4.4.0.0.0-4.4.0.3.0
Oracle iLearning Installation (Apache Groovy) 6.2, 6.3 6.2 · 6.3 · 6.3.1

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.codehaus.groovy:groovy 2.0.0 2.4.21 unbounded
org.codehaus.groovy:groovy 2.5.0 2.5.14 unbounded
org.codehaus.groovy:groovy 3.0.0 3.0.7 unbounded
org.codehaus.groovy:groovy-all 2.0.0 2.4.21 unbounded
org.codehaus.groovy:groovy-all 2.5.0 2.5.14 unbounded
org.codehaus.groovy:groovy-all 3.0.0 3.0.7 unbounded

Products and versions

23 products, 45 version entries
SourceVendorProductSchemeAffected versions
nvd apache atlas generic 2.1.0
nvd apache groovy generic ≥ 2.0.0 and ≤ 2.4.20 · ≥ 2.5.0 and ≤ 2.5.13 · ≥ 3.0.0 and ≤ 3.0.6 · 4.0.0:alpha1
nvd netapp snapcenter generic any version
nvd oracle agile engineering data management generic 6.2.1.0
nvd oracle agile plm mcad connector generic 3.4 · 3.6
nvd oracle agile product lifecycle management generic 9.3.3 · 9.3.6
nvd oracle business process management suite generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle communications brm - elastic charging engine generic 11.3.0.9.0 · 12.0.0.3
nvd oracle communications diameter signaling router generic 8.4.0.0
nvd oracle communications evolved communications application server generic 7.1
nvd oracle communications services gatekeeper generic 6.0 · 6.1 · 7.0
nvd oracle healthcare data repository generic 7.0.2
nvd oracle hospitality opera 5 generic 5.6
nvd oracle ilearning generic 6.2 · 6.3
nvd oracle insurance policy administration generic ≥ 11.0 and ≤ 11.3.1
nvd oracle jd edwards enterpriseone orchestrator generic 9.2.6.0
nvd oracle primavera gateway generic ≥ 17.12.0 and ≤ 17.12.10
nvd oracle primavera unifier generic 16.1 · 16.2 · ≥ 17.7 and ≤ 17.12 · 18.8 · 19.12 · 20.12
nvd oracle retail bulk data integration generic 15.0.3.0 · 16.0.3.0
nvd oracle retail merchandising system generic 16.0.3
nvd oracle retail store inventory management generic 14.1.3.10 · 15.0.3.5 · 16.0.3.5
osv org.codehaus.groovy groovy generic ≥ 2.0.0 and ＜ 2.4.21 · ≥ 2.5.0 and ＜ 2.5.14 · ≥ 3.0.0 and ＜ 3.0.7
osv org.codehaus.groovy groovy-all generic ≥ 2.0.0 and ＜ 2.4.21 · ≥ 2.5.0 and ＜ 2.5.14 · ≥ 3.0.0 and ＜ 3.0.7

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** ADMIN (APACHE GROOVY), E1 IOT ORCHESTRATOR (APACHE GROOVY), INSTALL UTILITY (APACHE GROOVY), PEOPLESOFT INTEGRATION BUGS (APACHE GROOVY), REPORTING (APACHE GROOVY), SECURITY (APACHE GROOVY), INSTALLATION (APACHE GROOVY), RSB KERNEL (APACHE GROOVY), RIB KERNAL (APACHE GROOVY), CONTROL ENGINE (APACHE GROOVY), SIM INTEGRATION (APACHE GROOVY), ELASTIC CHARGING CONTROLLER (APACHE GROOVY), ORCHESTRATION (APACHE GROOVY), BDI JOB SCHEDULER (APACHE GROOVY), CAX CLIENT (APACHE GROOVY), FOUNDATION (APACHE GROOVY), PLATFORM (APACHE GROOVY), PRM (APACHE GROOVY), ARCHITECTURE (APACHE GROOVY) **Products:** PRIMAVERA UNIFIER, ORACLE HEALTHCARE DATA REPOSITORY, ORACLE ILEARNING, ORACLE AGILE PLM MCAD CONNECTOR, ORACLE RETAIL FINANCIAL INTEGRATION, ORACLE RETAIL MERCHANDISING SYSTEM, ORACLE RETAIL BULK DATA INTEGRATION, ORACLE RETAIL APPLICATIONS, GROOVY, ORACLE RETAIL STORE INVENTORY MANAGEMENT, ORACLE SUPPLY CHAIN, ORACLE AGILE PLM, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE JD EDWARDS, ORACLE INSURANCE APPLICATIONS, ORACLE COMMUNICATIONS EVOLVED COMMUNICATIONS APPLICATION SERVER, ORACLE COMMUNICATIONS BRM - ELASTIC CHARGING ENGINE, ORACLE HOSPITALITY OPERA 5, PRIMAVERA GATEWAY, ORACLE HOSPITALITY APPLICATIONS, ORACLE INSURANCE POLICY ADMINISTRATION, ORACLE RETAIL INTEGRATION BUS, ORACLE COMMUNICATIONS, ORACLE COMMUNICATIONS SERVICES GATEKEEPER, ORACLE RETAIL SERVICE BACKBONE, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS, JD EDWARDS ENTERPRISEONE ORCHESTRATOR

References

URLTags
https://github.com/apache/groovy/pull/1425 WEB
https://github.com/apache/groovy/commit/bcbe5c4c76db83736166530647c024ac1e47ef28 WEB
https://github.com/apache/groovy PACKAGE
https://groovy-lang.org/security.html#CVE-2020-17521 WEB
https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08@%3Cdev.atlas.apache.org%3E WEB
https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3E WEB
https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3@%3Cdev.atlas.apache.org%3E WEB
https://security.netapp.com/advisory/ntap-20201218-0006 WEB
https://www.oracle.com//security-alerts/cpujul2021.html WEB
https://www.oracle.com/security-alerts/cpuApr2021.html WEB

Timeline
Published2020-12-07By the CVE Program.
NVD record modified2026-10-08NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.