What is the CVSS score of CVE-2020-1945?

CVE-2020-1945 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 1.8%.

Is there a patch available for CVE-2020-1945?

Yes, a patch is available for CVE-2020-1945. Update the affected software to the latest version immediately.

Java CVE-2020-1945

MEDIUM

Exposure of Resource to Wrong Sphere (CWE-668)

2020-05-14 security@apache.org

Apache Java Information Disclosure Ant Ubuntu Linux Fedora Leap Agile Engineering Data Management Banking Enterprise Collections Banking Liquidity Management Banking Platform Business Process Management Suite Category Management Planning Optimization Communications Asap Communications Diameter Signaling Router Communications Metasolv Solution Communications Order And Service Management Data Integrator Endeca Information Discovery Studio Enterprise Manager Ops Center Enterprise Repository Financial Services Analytical Applications Infrastructure Flexcube Investor Servicing Flexcube Private Banking Health Sciences Information Manager Primavera Gateway Primavera Unifier Rapid Planning Real Time Decision Server Retail Advanced Inventory Planning Retail Assortment Planning Retail Back Office Retail Bulk Data Integration Retail Central Office Retail Data Extractor For Merchandising Retail Extract Transform And Load Retail Financial Integration Retail Integration Bus Retail Item Planning Retail Macro Space Optimization Retail Merchandise Financial Planning Retail Merchandising System Retail Point Of Service Retail Predictive Application Server Retail Regular Price Optimization Retail Replenishment Optimization Retail Returns Management Retail Service Backbone Retail Size Profile Optimization Retail Store Inventory Management Retail Xstore Point Of Service Timesten In Memory Database Utilities Framework

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

May 14, 2020 - 16:15 nvd

MEDIUM 6.3

DescriptionNVD

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

AnalysisAI

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. Rated medium severity (CVSS 6.3). This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.

Technical ContextAI

This vulnerability is classified as Exposure of Resource to Wrong Sphere (CWE-668), which allows attackers to access resources from an unintended security context. Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process. Affected products include: Apache Ant, Canonical Ubuntu Linux, Fedoraproject Fedora, Opensuse Leap, Oracle Agile Engineering Data Management.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement proper access controls, validate resource access permissions, use security boundaries.