Insecure Default

Affecting org.apache.ant:ant artifact, versions [1.1,1.9.15) || [1.10.0,1.10.8)

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

org.apache.ant:ant is a software tool for automating software build processes which originated from the Apache Tomcat project in early 2000.

Affected versions of this package are vulnerable to Insecure Default. It uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Remediation

Upgrade org.apache.ant:ant to version 1.9.15, 1.10.8 or higher.

References

CVSS Score

6.5
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    Low
  • Availability
    None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Credit
Mike Salvatore
CVE
CVE-2020-1945
CWE
CWE-453
Snyk ID
SNYK-JAVA-ORGAPACHEANT-569130
Disclosed
14 May, 2020
Published
14 May, 2020