CVE-2020-1945

Published May 14, 2020

Last updated a year ago

Overview

Description
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
Source
security@apache.org
NVD status
Modified

Risk scores

CVSS 3.1

Type
Primary
Base score
6.3
Impact score
5.2
Exploitability score
1
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
3.3
Impact score
4.9
Exploitability score
3.4
Vector string
AV:L/AC:M/Au:N/C:P/I:P/A:N

Weaknesses

nvd@nist.gov
CWE-668

Social media

Hype score
Not currently trending

Configurations

References