CVE-2020-17521: groovy from 2.0.0 (inclusive), through 2.4.20 (inclusive), from 2.5.0 (inclusive), through 2.5.13 (inclusive), from…

Affected technology

groovy · from 2.0.0 (inclusive), through 2.4.20 (inclusive)
apache

groovy · from 2.5.0 (inclusive), through 2.5.13 (inclusive)
apache

groovy · from 3.0.0 (inclusive), through 3.0.6 (inclusive)
apache

groovy · 4.0.0 · update alpha1
apache

snapcenter · Version not applicable in the source CPE
netapp

agile engineering data management · 6.2.1.0
oracle

agile plm mcad connector · 3.4
oracle

agile plm mcad connector · 3.6
oracle

agile product lifecycle management · 9.3.3
oracle

agile product lifecycle management · 9.3.6
oracle

business process management suite · 12.2.1.3.0
oracle

business process management suite · 12.2.1.4.0
oracle

communications brm - elastic charging engine · 11.3.0.9.0
oracle

communications brm - elastic charging engine · 12.0.0.3
oracle

communications diameter signaling router · 8.4.0.0
oracle

communications evolved communications application server · 7.1
oracle

communications services gatekeeper · 6.0
oracle

communications services gatekeeper · 6.1
oracle

communications services gatekeeper · 7.0
oracle

healthcare data repository · 7.0.2
oracle

hospitality opera 5 · 5.6
oracle

ilearning · 6.2
oracle

ilearning · 6.3
oracle

insurance policy administration · from 11.0 (inclusive), through 11.3.1 (inclusive)
oracle

jd edwards enterpriseone orchestrator · 9.2.6.0
oracle

primavera gateway · from 17.12.0 (inclusive), through 17.12.10 (inclusive)
oracle

primavera unifier · from 17.7 (inclusive), through 17.12 (inclusive)
oracle

primavera unifier · 16.1
oracle

primavera unifier · 16.2
oracle

primavera unifier · 18.8
oracle

primavera unifier · 19.12
oracle

primavera unifier · 20.12
oracle

retail bulk data integration · 15.0.3.0
oracle

retail bulk data integration · 16.0.3.0
oracle

retail merchandising system · 16.0.3
oracle

retail store inventory management · 14.1.3.10
oracle

retail store inventory management · 15.0.3.5
oracle

retail store inventory management · 16.0.3.5
oracle

atlas · 2.1.0
apache

Apache Groovy · 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, 4.0.0-alpha-1
Apache Software Foundation

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.