Back
CVE-2017-15288
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in…
- 7.8HighCVSS base score
- 0.35%Exploitation in 30 daysEPSS · top 72% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
Timeline
ID reserved
By mitre
- 34 days later
· 34 days later
Published
- 7 years later
· 7 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.35% · top 72% of all CVEs (9 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
n/a
- affected n/a
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.scala-lang:scala-compilerGHSA-qvxv-pmq9-4q7g (opens in a new tab)
References
19
- https://github.com/scala/scala/pull/6128 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/scala/scala/pull/6120 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/scala/scala/pull/6108 (opens in a new tab)x_refsource_CONFIRMx_transferred
- GLSA-201812-08 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- http://scala-lang.org/news/security-update-nov17.html (opens in a new tab)x_refsource_CONFIRMx_transferred
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [kafka-dev] 20210211 [jira] [Created] (KAFKA-12325) Update to secure versions of scala libraries due to CVE-2017-15288 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [kafka-jira] 20210211 [jira] [Updated] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [kafka-jira] 20210211 [jira] [Created] (KAFKA-12325) Update to secure versions of scala libraries due to CVE-2017-15288 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [kafka-jira] 20210212 [jira] [Commented] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [kafka-jira] 20210214 [jira] [Commented] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [kafka-jira] 20210215 [jira] [Commented] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [kafka-dev] 20210215 [jira] [Resolved] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [kafka-jira] 20210215 [jira] [Resolved] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [druid-commits] 20210302 [GitHub] [druid] abhishekagarwal87 opened a new pull request #10933: Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15on (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [druid-commits] 20210302 [GitHub] [druid] maytasm merged pull request #10933: Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15on (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2018-0669 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-qvxv-pmq9-4q7g (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2017-15288)Record last updated .