Path to dependency file: /tmp/ws-scm/proctor/coverage-report/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/ant/ant/1.8.2/ant-1.8.2.jar,canner/.m2/repository/org/apache/ant/ant/1.8.2/ant-1.8.2.jar
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
CVE-2020-1945 - Medium Severity Vulnerability
master POM
Path to dependency file: /tmp/ws-scm/proctor/coverage-report/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/ant/ant/1.8.2/ant-1.8.2.jar,canner/.m2/repository/org/apache/ant/ant/1.8.2/ant-1.8.2.jar
Dependency Hierarchy: - :x: **ant-1.8.2.jar** (Vulnerable Library)
Found in HEAD commit: 151dc45fc7c1c05aedd4f218e9bc0cced914ed1c
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
Publish Date: 2020-05-14
URL: CVE-2020-1945
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://ant.apache.org/security.html
Release Date: 2020-05-14
Fix Resolution: org.apache.ant:ant-junitlauncher:1.10.8;org.apache.ant:ant:1.9.15,1.10.8