CVE-2020-9488

Aliases:GHSA-vwqq-5vrc-xw9h
Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 27 Apr 2020, 15:36
Last modified:29 May 2026, 16:07

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
0.03% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Apr 2020, 15:36
Published
Vulnerability first disclosed
29 May 2026, 16:07
Last Modified
Vulnerability information updated

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

CVSS Metrics

  • v3.1•LOW•Score: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.03%• Percentile: 9%

Techniques & Countermeasures

  • CWE-295•Improper Certificate Validation

    The product does not validate, or incorrectly validates, a certificate.

Affected Systems

  • apache•apache log4j

    log4j-core 2.13.0 | ≥ log4j-core, < 2.12.3

  • apache•log4j

    ≥ 2.0, < 2.3.2 | ≥ 2.4, < 2.12.3 | ≥ 2.13.0, < 2.13.2

  • debian•debian_linux

    9.0 | 10.0 | 11.0

  • org.apache.logging.log4j•log4j

    ≥ 2.13.0, < 2.13.2 | ≥ 2.4.0, < 2.12.3 | < 2.3.2

  • org.apache.logging.log4j•log4j-core

    ≥ 2.13.0, < 2.13.2 | ≥ 2.4.0, < 2.12.3 | < 2.3.2

  • oracle•communications_application_session_controller

    3.9m0p1

  • oracle•communications_billing_and_revenue_management

    7.5.0.23.0 | 12.0.0.3.0

  • oracle•communications_eagle_ftp_table_base_retrieval

    4.5

  • oracle•communications_offline_mediation_controller

    12.0.0.3.0

  • oracle•communications_services_gatekeeper

    7.0

  • oracle•communications_unified_inventory_management

    7.3.0 | 7.4.0

  • oracle•data_integrator

    12.2.1.3.0 | 12.2.1.4.0

  • oracle•enterprise_manager_for_peoplesoft

    13.4.1.1

  • oracle•financial_services_analytical_applications_infrastructure

    ≥ 8.0.6.0.0, ≤ 8.1.0.0.0

  • oracle•financial_services_institutional_performance_analytics

    8.0.6 | 8.1.0 | 8.7.0

  • oracle•financial_services_market_risk_measurement_and_management

    8.0.6 | 8.0.8 | 8.1.0

  • oracle•financial_services_price_creation_and_discovery

    8.0.6 | 8.0.7

  • oracle•financial_services_retail_customer_analytics

    8.0.6

  • oracle•flexcube_core_banking

    ≥ 11.5.0, ≤ 11.7.0 | 5.2.0

  • oracle•flexcube_private_banking

    12.0.0 | 12.1.0

  • oracle•health_sciences_information_manager

    3.0.1

  • oracle•insurance_insbridge_rating_and_underwriting

    ≥ 5.0.0.0, ≤ 5.6.0.0 | 5.6.1.0

  • oracle•insurance_policy_administration_j2ee

    10.2.0.37 | 10.2.4.12 | 11.0.2.25 | 11.1.0.15 | 11.2.0.26

  • oracle•insurance_rules_palette

    10.2.0.37 | 10.2.4.12 | 11.0.2.25 | 11.1.0.15 | 11.2.0.26

  • oracle•jd_edwards_world_security

    a9.4

  • oracle•oracle_goldengate_application_adapters

    19.1.0.0.0

  • oracle•peoplesoft_enterprise_peopletools

    8.56 | 8.57 | 8.58

  • oracle•policy_automation

    ≥ 12.2.0, ≤ 12.2.20

  • oracle•policy_automation_connector_for_siebel

    10.4.6

  • oracle•policy_automation_for_mobile_devices

    ≥ 12.2.0, ≤ 12.2.20

  • oracle•primavera_unifier

    18.8 | 19.12

  • oracle•retail_advanced_inventory_planning

    14.1

  • oracle•retail_assortment_planning

    15.0.3.0 | 16.0.3.0

  • oracle•retail_bulk_data_integration

    15.0.3.0 | 16.0.3.0

  • oracle•retail_customer_management_and_segmentation_foundation

    16.0 | 17.0 | 18.0 | 19.0

  • oracle•retail_eftlink

    15.0.2 | 16.0.3 | 17.0.2 | 18.0.1 | 19.0.1

  • oracle•retail_insights_cloud_service_suite

    19.0

  • oracle•retail_integration_bus

    14.1 | 15.0 | 16.0

  • oracle•retail_order_broker_cloud_service

    16.0 | 18.0 | 19.0 | 19.1 | 19.2 | 19.3

  • oracle•retail_predictive_application_server

    14.1.3.0 | 15.0.3.0 | 16.0.3.0

  • oracle•retail_xstore_point_of_service

    15.0.4 | 16.0.6 | 17.0.4 | 18.0.3 | 19.0.2

  • oracle•siebel_apps_-_marketing

    ≤ 21.9

  • oracle•siebel_ui_framework

    ≤ 21.2

  • oracle•spatial_and_graph

    12.2.0.1 | 18c | 19c

  • oracle•storagetek_acsls

    8.5.1

  • oracle•storagetek_tape_analytics_sw_tool

    2.3.1

  • oracle•utilities_framework

    ≥ 4.3.0.1.0, ≤ 4.3.0.6.0 | 2.2.0.0.0 | 4.2.0.2.0 | 4.2.0.3.0 | 4.4.0.0.0 | 4.4.0.2.0

  • Unknown•WebLogic Server

    10.3.6.0.0

  • qos•reload4j

    < 1.2.18.3

References (90)