Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-1945

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Published

2020-05-14T16:15:12.767

Last Modified

2024-11-21T05:11:42.183

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.3 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

3.4

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-668
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache ant ≤ 1.9.14 Yes
Application apache ant ≤ 1.10.7 Yes
Operating System canonical ubuntu_linux 19.10 Yes
Operating System fedoraproject fedora 31 Yes
Operating System fedoraproject fedora 32 Yes
Operating System opensuse leap 15.2 Yes
Application oracle agile_engineering_data_management 6.2.1.0 Yes
Application oracle banking_enterprise_collections ≤ 2.9.0 Yes
Application oracle banking_liquidity_management ≤ 14.4.0 Yes
Application oracle banking_platform ≤ 2.9.0 Yes
Application oracle business_process_management_suite 12.2.1.3.0 Yes
Application oracle business_process_management_suite 12.2.1.4.0 Yes
Application oracle category_management_planning_\&_optimization 15.0.3 Yes
Application oracle communications_asap 7.3 Yes
Application oracle communications_diameter_signaling_router ≤ 8.2.2 Yes
Application oracle communications_metasolv_solution 6.3.0 Yes
Application oracle communications_order_and_service_management 7.3 Yes
Application oracle communications_order_and_service_management 7.4 Yes
Application oracle data_integrator 12.2.1.3.0 Yes
Application oracle data_integrator 12.2.1.4.0 Yes
Application oracle endeca_information_discovery_studio 3.2.0 Yes
Application oracle enterprise_manager_ops_center 12.4.0.0 Yes
Application oracle enterprise_repository 11.1.1.7.0 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 8.1.0 Yes
Application oracle flexcube_investor_servicing 12.1.0 Yes
Application oracle flexcube_investor_servicing 12.3.0 Yes
Application oracle flexcube_investor_servicing 12.4.0 Yes
Application oracle flexcube_investor_servicing 14.0.0 Yes
Application oracle flexcube_investor_servicing 14.1.0 Yes
Application oracle flexcube_private_banking 12.0.0 Yes
Application oracle flexcube_private_banking 12.1.0 Yes
Application oracle health_sciences_information_manager ≤ 3.0.2 Yes
Application oracle primavera_gateway ≤ 16.2.11 Yes
Application oracle primavera_gateway ≤ 17.12.7 Yes
Application oracle primavera_unifier ≤ 17.12 Yes
Application oracle primavera_unifier 16.1 Yes
Application oracle primavera_unifier 16.2 Yes
Application oracle primavera_unifier 18.8 Yes
Application oracle primavera_unifier 19.12 Yes
Application oracle rapid_planning 12.1 Yes
Application oracle rapid_planning 12.2 Yes
Application oracle real-time_decision_server 3.2.1.0 Yes
Application oracle retail_advanced_inventory_planning 14.1 Yes
Application oracle retail_advanced_inventory_planning 15.0 Yes
Application oracle retail_advanced_inventory_planning 16.0 Yes
Application oracle retail_assortment_planning 15.0.3 Yes
Application oracle retail_assortment_planning 16.0.3 Yes
Application oracle retail_back_office 14.0 Yes
Application oracle retail_back_office 14.1 Yes
Application oracle retail_bulk_data_integration 15.0 Yes
Application oracle retail_bulk_data_integration 16.0 Yes
Application oracle retail_bulk_data_integration 16.0.3.0 Yes
Application oracle retail_bulk_data_integration 19.0.1 Yes
Application oracle retail_central_office 14.0 Yes
Application oracle retail_central_office 14.1 Yes
Application oracle retail_data_extractor_for_merchandising 1.9 Yes
Application oracle retail_data_extractor_for_merchandising 1.10 Yes
Application oracle retail_extract_transform_and_load 13.2.5 Yes
Application oracle retail_extract_transform_and_load 13.2.8 Yes
Application oracle retail_financial_integration 14.1.3.2 Yes
Application oracle retail_financial_integration 15.0 Yes
Application oracle retail_financial_integration 15.0.4.0 Yes
Application oracle retail_financial_integration 16.0 Yes
Application oracle retail_financial_integration 16.0.3.0 Yes
Application oracle retail_integration_bus 14.1 Yes
Application oracle retail_integration_bus 14.1.3.2 Yes
Application oracle retail_integration_bus 15.0 Yes
Application oracle retail_integration_bus 15.0.4.0 Yes
Application oracle retail_integration_bus 16.0 Yes
Application oracle retail_integration_bus 16.0.3.0 Yes
Application oracle retail_integration_bus 19.0.1.0 Yes
Application oracle retail_item_planning 15.0.3 Yes
Application oracle retail_macro_space_optimization 15.0.3 Yes
Application oracle retail_merchandise_financial_planning 15.0.3 Yes
Application oracle retail_merchandising_system 19.0.1 Yes
Application oracle retail_point-of-service 14.0 Yes
Application oracle retail_point-of-service 14.1 Yes
Application oracle retail_point-of-service 15.0 Yes
Application oracle retail_point-of-service 16.0 Yes
Application oracle retail_predictive_application_server 14.0.3 Yes
Application oracle retail_predictive_application_server 14.1.3 Yes
Application oracle retail_predictive_application_server 15.0.3 Yes
Application oracle retail_predictive_application_server 16.0.3 Yes
Application oracle retail_predictive_application_server 16.0.3.0 Yes
Application oracle retail_regular_price_optimization 15.0.3 Yes
Application oracle retail_regular_price_optimization 16.0.3 Yes
Application oracle retail_replenishment_optimization 15.0.3 Yes
Application oracle retail_returns_management 14.0 Yes
Application oracle retail_returns_management 14.1 Yes
Application oracle retail_service_backbone 14.1.3.2 Yes
Application oracle retail_service_backbone 15.0 Yes
Application oracle retail_service_backbone 15.0.4.0 Yes
Application oracle retail_service_backbone 16.0 Yes
Application oracle retail_service_backbone 16.0.3.0 Yes
Application oracle retail_service_backbone 19.0.1.0 Yes
Application oracle retail_size_profile_optimization 15.0.3 Yes
Application oracle retail_size_profile_optimization 16.0.3 Yes
Application oracle retail_store_inventory_management 14.0.4 Yes
Application oracle retail_store_inventory_management 14.1 Yes
Application oracle retail_store_inventory_management 14.1.3 Yes
Application oracle retail_store_inventory_management 15.0 Yes
Application oracle retail_store_inventory_management 15.0.3 Yes
Application oracle retail_store_inventory_management 16.0 Yes
Application oracle retail_store_inventory_management 16.0.3 Yes
Application oracle retail_xstore_point_of_service 15.0.4 Yes
Application oracle retail_xstore_point_of_service 16.0.6 Yes
Application oracle retail_xstore_point_of_service 17.0.4 Yes
Application oracle retail_xstore_point_of_service 18.0.3 Yes
Application oracle retail_xstore_point_of_service 19.0.2 Yes
Application oracle timesten_in-memory_database < 11.2.2.8.27 Yes
Application oracle timesten_in-memory_database 11.2.2.8.49 Yes
Application oracle utilities_framework ≤ 4.3.0.6.0 Yes
Application oracle utilities_framework 2.2.0.0.0 Yes
Application oracle utilities_framework 4.2.0.2.0 Yes
Application oracle utilities_framework 4.2.0.3.0 Yes
Application oracle utilities_framework 4.4.0.0.0 Yes
Application oracle utilities_framework 4.4.0.2.0 Yes
References