CVEvulnerability

CVE-2020-1945

6.3 MEDIUM Published 2020-05-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-05-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
3.3 LOW — AV:L/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-668

Description

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Affected configurations

• apache ant (>= 1.1 <= 1.9.14) • apache ant (>= 1.10.0 <= 1.10.7) • canonical ubuntu linux 19.10 • fedoraproject fedora 31 • fedoraproject fedora 32 • opensuse leap 15.2 • oracle agile engineering data management 6.2.1.0 • oracle banking enterprise collections (>= 2.7.0 <= 2.9.0) • oracle banking liquidity management (>= 14.0.0 <= 14.4.0) • oracle banking platform (>= 2.4.0 <= 2.9.0) • oracle business process management suite 12.2.1.3.0 • oracle business process management suite 12.2.1.4.0 • oracle category management planning \& optimization 15.0.3 • oracle communications asap 7.3 • oracle communications diameter signaling router (>= 8.0.0 <= 8.2.2) • oracle communications metasolv solution 6.3.0 • oracle communications order and service management 7.3 • oracle communications order and service management 7.4 • oracle data integrator 12.2.1.3.0 • oracle data integrator 12.2.1.4.0 • oracle endeca information discovery studio 3.2.0 • oracle enterprise manager ops center 12.4.0.0 • oracle enterprise repository 11.1.1.7.0 • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.1.0) • oracle flexcube investor servicing 12.1.0 • oracle flexcube investor servicing 12.3.0 • oracle flexcube investor servicing 12.4.0 • oracle flexcube investor servicing 14.0.0 • oracle flexcube investor servicing 14.1.0 • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle health sciences information manager (>= 3.0 <= 3.0.2) • oracle primavera gateway (>= 16.2.0 <= 16.2.11) • oracle primavera gateway (>= 17.12.0 <= 17.12.7) • oracle primavera unifier (>= 17.7 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle rapid planning 12.1 • oracle rapid planning 12.2 • oracle real-time decision server 3.2.1.0 • oracle retail advanced inventory planning 14.1 • oracle retail advanced inventory planning 15.0 • oracle retail advanced inventory planning 16.0 • oracle retail assortment planning 15.0.3 • oracle retail assortment planning 16.0.3 • oracle retail back office 14.0 • oracle retail back office 14.1 • oracle retail bulk data integration 15.0 • oracle retail bulk data integration 16.0 • oracle retail bulk data integration 16.0.3.0 • oracle retail bulk data integration 19.0.1 • oracle retail central office 14.0 • oracle retail central office 14.1 • oracle retail data extractor for merchandising 1.9 • oracle retail data extractor for merchandising 1.10 • oracle retail extract transform and load 13.2.5 • oracle retail extract transform and load 13.2.8 • oracle retail financial integration 14.1.3.2 … and 57 more

Related

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References