CVE-2020-11979

mediumpriority · track · 33EPSS 0.078 · 95 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

7.76% (95th) EPSS

CVSS 5 · medium

Is it mine?

122 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · NCSC-NL NL

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-377USCWE-379USCWE-74USCWE-74USCWE-94US

affected products (122)

Products and version ranges known to be affected.

Dell ECS <3.8.1.0all versionscert_bundDE
Dell PowerEdgeall versionscert_bundDEcpe:/h:dell:poweredge:-
IBM InfoSphere Information Serverall versionscert_bundDEcpe:/a:ibm:infosphere_information_server:-
Dell ECS< 3.8.1.0cert_bundDE
n/a Apache Ant≤ Apache Ant 1.10.8enisa_euvdEU
Apache Software Foundation Ant≤ 1.10.8fstec_bduRU
Fedora Project Fedora≤ 32fstec_bduRU
Fedora Project Fedora≤ 31fstec_bduRU
Fedora Project Fedora≤ 33fstec_bduRU
Oracle Corp. Banking Platform≤ 2.6.2fstec_bduRU
Oracle Corp. Banking Platform≤ 2.4.1fstec_bduRU
Oracle Corp. Banking Platform≤ 2.7.1fstec_bduRU
Oracle Corp. Banking Platform≤ 2.7.0fstec_bduRU
Oracle Corp. Banking Platform≤ 2.4.0fstec_bduRU
Oracle Corp. Banking Platform≤ 2.8.0fstec_bduRU
Oracle Corp. Enterprise Repository≤ 11.1.1.7.0fstec_bduRU
Oracle Corp. Financial Services Analytical Applications Infrastructure8.0.6 → 8.1.0fstec_bduRU
Oracle Corp. Oracle Banking Liquidity Management14.0.0 → 14.4.0fstec_bduRU
Oracle Corp. Oracle Communications ASAP≤ 7.3fstec_bduRU
Oracle Corp. Oracle Real-Time Decision Server≤ 3.2.1.0fstec_bduRU

showing 20 of 122

advisories (6)

Vendor and ecosystem advisories describing this.

NCSC-2025-0064Kwetsbaarheden verholpen in IBM Cognos ControllerNL2025-02-21csaf · ncsc_nlNL
IBM heeft kwetsbaarheden verholpen in IBM Cognos Controller (Versies 11.0.0 tot 11.0.1 FP3 en 11.1.0).
WID-SEC-W-2023-0119Oracle Utilities Applications: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
GHSA-f62v-xpxf-3v68Code injection in Apache Ant2021-02-03ghsa · osvUS
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
BIT-gradle-2020-119792024-03-06vendor · osvUS
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl NVD CVE.org MITRE

published 2020-10-01modified 2026-06-17

references (83)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan