CVE-2020-1945

6.3 mediumEPSS 1.8%

Medium (6.3). EPSS 1.8% chance of exploitation in the next 30 days. Fixed in org.apache.ant:ant 1.10.8, 1.9.15.

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Severity

CVSS 3.1

6.3 medium

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-668
Published: 2020-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:ant
canonical:ubuntu_linux
fedoraproject:fedora
opensuse:leap
oracle:agile_engineering_data_management
oracle:banking_enterprise_collections
oracle:banking_liquidity_management
oracle:banking_platform
oracle:business_process_management_suite
oracle:category_management_planning_\&_optimization
oracle:communications_asap
oracle:communications_diameter_signaling_router
oracle:communications_metasolv_solution
oracle:communications_order_and_service_management
oracle:data_integrator
oracle:endeca_information_discovery_studio
oracle:enterprise_manager_ops_center
oracle:enterprise_repository
oracle:financial_services_analytical_applications_infrastructure
oracle:flexcube_investor_servicing
oracle:flexcube_private_banking
oracle:health_sciences_information_manager
oracle:primavera_gateway
oracle:primavera_unifier
oracle:rapid_planning
oracle:real-time_decision_server
oracle:retail_advanced_inventory_planning
oracle:retail_assortment_planning
oracle:retail_back_office
oracle:retail_bulk_data_integration
oracle:retail_central_office
oracle:retail_data_extractor_for_merchandising
oracle:retail_extract_transform_and_load
oracle:retail_financial_integration
oracle:retail_integration_bus
oracle:retail_item_planning
oracle:retail_macro_space_optimization
oracle:retail_merchandise_financial_planning
oracle:retail_merchandising_system
oracle:retail_point-of-service
oracle:retail_predictive_application_server
oracle:retail_regular_price_optimization
oracle:retail_replenishment_optimization
oracle:retail_returns_management
oracle:retail_service_backbone
oracle:retail_size_profile_optimization
oracle:retail_store_inventory_management
oracle:retail_xstore_point_of_service
oracle:timesten_in-memory_database
oracle:utilities_framework

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4p6w-m9wc-c9c9	Maven	org.apache.ant:ant	>=1.1 <1.9.15	1.9.15
GHSA-4p6w-m9wc-c9c9	Maven	org.apache.ant:ant	>=1.10.0 <1.10.8	1.10.8

References

Check your stack JSON