What is the CVSS score of CVE-2020-11979?

CVE-2020-11979 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 8.2%.

Is there a patch available for CVE-2020-11979?

Yes, a patch is available for CVE-2020-11979. Update the affected software to the latest version immediately.

Ant CVE-2020-11979

HIGH

Creation of Temporary File in Directory with Insecure Permissions (CWE-379)

2020-10-01 security@apache.org

Apache Code Injection Ant Gradle Fedora Agile Engineering Data Management Api Gateway Banking Platform Banking Treasury Management Communications Unified Inventory Management Data Integrator Endeca Information Discovery Studio Enterprise Repository Financial Services Analytical Applications Infrastructure Flexcube Private Banking Primavera Gateway Primavera Unifier Real Time Decision Server Retail Advanced Inventory Planning Retail Assortment Planning Retail Category Management Planning Optimization Retail Eftlink Retail Financial Integration Retail Integration Bus Retail Item Planning Retail Macro Space Optimization Retail Merchandise Financial Planning Retail Merchandising System Retail Predictive Application Server Retail Regular Price Optimization Retail Replenishment Optimization Retail Service Backbone Retail Size Profile Optimization Retail Store Inventory Management Retail Xstore Point Of Service Storagetek Acsls Storagetek Tape Analytics Timesten In Memory Database Utilities Framework

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Oct 01, 2020 - 20:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,038 maven packages depend on org.apache.ant:ant (157 direct, 883 indirect)

Ecosystem-wide dependent count for version 1.10.9.

DescriptionNVD

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

AnalysisAI

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-379. As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process. Affected products include: Apache Ant, Gradle, Fedoraproject Fedora, Oracle Agile Engineering Data Management, Oracle Api Gateway.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.