Incorrect default permissions in Apache Groovy - CVE-2020-17521

Vulnerability identifier: #VU48792

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-17521

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for temporary files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

Apache Groovy
Arch Linux
Oracle Solaris Cluster
Oracle Agile PLM MCAD Connector
Oracle Utilities Application Framework
Oracle Hospitality OPERA 5
Oracle Business Process Management Suite
Oracle Retail Bulk Data Integration
Oracle Communications Services Gatekeeper
Oracle iLearning
Oracle Agile Engineering Data Management
Oracle Data Integrator
Oracle Retail Store Inventory Management
Oracle Retail Service Backbone
MobileFirst Platform
Oracle Communications Evolved Communications Application Server
Oracle WebLogic Server
Primavera Gateway
Fuse
Oracle Communications Diameter Signaling Router
Oracle Identity Manager Connector
Oracle Enterprise Data Quality
IBM Spectrum Control
IBM Cloud Application Performance Management (APM)
Oracle Agile PLM Framework
Oracle Communications BRM - Elastic Charging Engine
Oracle Retail Financial Integration
Oracle Retail Merchandising System
Oracle Retail Integration Bus
Primavera Unifier
Splunk AppDynamics Analytics Agent
RSA Authentication Manager

Install updates from vendor's website.

Apache Groovy - addressed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0.ALPHA.2
IBM Spectrum Control - update to 5.4.10
Fuse - update to 7.10.0
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202301121031
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.20
RSA Authentication Manager - update to 8.7 Patch 2
Splunk AppDynamics Analytics Agent - update to 26.1.0

• http://seclists.org/oss-sec/2020/q4/183

• Privilege escalation in Apache Groovy
• Multiple vulnerabilities in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Integration Bus
• Multiple vulnerabilities in Oracle Retail Financial Integration
• Multiple vulnerabilities in Oracle Retail Bulk Data Integration
• Arch Linux update for groovy
• Incorrect default permissions in Oracle Communications Services Gatekeeper
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Primavera Unifier
• Incorrect default permissions in Oracle iLearning
• Multiple vulnerabilities in Oracle Hospitality OPERA 5
• Incorrect default permissions in Oracle Retail Store Inventory Management
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Communications Evolved Communications Application Server
• Incorrect default permissions in Oracle Agile PLM MCAD Connector
• Incorrect default permissions in Oracle Communications Diameter Signaling Router
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Multiple vulnerabilities in Oracle Agile Engineering Data Management
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Incorrect default permissions in Oracle Agile PLM Framework
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Data Integrator
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in Oracle iLearning
• Multiple vulnerabilities in Oracle Enterprise Data Quality
• Multiple vulnerabilities in APM JBoss and APM WebLogic Agent
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• Incorrect default permissions in Oracle Identity Manager Connector
• Multiple vulnerabilities in Fuse 7.10
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in Oracle Solaris Cluster
• Splunk AppDynamics Analytics Agent update for third-party components
• Multiple vulnerabilities in Oracle Utilities Application Framework