CVE-2020-15824

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.

• CWE-269

• http://www.openwall.com/lists/oss-security/2020/12/06/1Mailing List, Third Party Advisory
• https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/Vendor Advisory
• https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E
• https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E
• https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/12/06/1Mailing List, Third Party Advisory
• https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/Vendor Advisory
• https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E
• https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E
• https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Aug 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15819JetBrains YouTrack before 2020.2.10643 was vulnerable to SSR…5.3
• CVE-2020-1582A remote code execution vulnerability exists in Microsoft Ac…7.8
• CVE-2020-15820In JetBrains YouTrack before 2020.2.6881, the markdown parse…5.3
• CVE-2020-15821In JetBrains YouTrack before 2020.2.6881, a user without per…6.5
• CVE-2020-15822In JetBrains YouTrack before 2020.2.10514, SSRF is possible …7.3
• CVE-2020-15823JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF …7.5
• CVE-2020-15825In JetBrains TeamCity before 2020.1, users with the Modify G…8.8
• CVE-2020-15826In JetBrains TeamCity before 2020.1, users are able to assig…4.3
• CVE-2020-15827In JetBrains ToolBox version 1.17 before 1.17.6856, the set …7.5
• CVE-2020-15828In JetBrains TeamCity before 2020.1.1, project parameter val…6.5
• CVE-2020-15829In JetBrains TeamCity before 2019.2.3, password parameters c…5.3
• CVE-2020-1583An information disclosure vulnerability exists when Microsof…8.8