{"cve":"CVE-2020-9488","nvd":{"published":"2020-04-27T16:15:12.897","modified":"2026-06-17T03:28:02.483","status":"Modified","description":"Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7},"cwes":["CWE-295"],"references":["https://issues.apache.org/jira/browse/LOG4J2-2819","https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f%40%3Cissues.hive.apache.org%3E"],"products":["apache:log4j","debian:debian_linux","oracle:communications_application_session_controller","oracle:communications_billing_and_revenue_management","oracle:communications_eagle_ftp_table_base_retrieval","oracle:communications_offline_mediation_controller","oracle:communications_services_gatekeeper","oracle:communications_unified_inventory_management","oracle:data_integrator","oracle:enterprise_manager_for_peoplesoft","oracle:financial_services_analytical_applications_infrastructure","oracle:financial_services_institutional_performance_analytics","oracle:financial_services_market_risk_measurement_and_management","oracle:financial_services_price_creation_and_discovery","oracle:financial_services_retail_customer_analytics","oracle:flexcube_core_banking","oracle:flexcube_private_banking","oracle:health_sciences_information_manager","oracle:insurance_insbridge_rating_and_underwriting","oracle:insurance_policy_administration_j2ee","oracle:insurance_rules_palette","oracle:jd_edwards_world_security","oracle:oracle_goldengate_application_adapters","oracle:peoplesoft_enterprise_peopletools","oracle:policy_automation","oracle:policy_automation_connector_for_siebel","oracle:policy_automation_for_mobile_devices","oracle:primavera_unifier","oracle:retail_advanced_inventory_planning","oracle:retail_assortment_planning","oracle:retail_bulk_data_integration","oracle:retail_customer_management_and_segmentation_foundation","oracle:retail_eftlink","oracle:retail_insights_cloud_service_suite","oracle:retail_integration_bus","oracle:retail_order_broker_cloud_service","oracle:retail_predictive_application_server","oracle:retail_xstore_point_of_service","oracle:siebel_apps_-_marketing","oracle:siebel_ui_framework","oracle:spatial_and_graph","oracle:storagetek_acsls","oracle:storagetek_tape_analytics_sw_tool","oracle:utilities_framework","oracle:weblogic_server","qos:reload4j"],"source":"nvd","synced_at":"2026-10-19T21:04:18.695612450+00:00"},"epss":{"cve":"CVE-2020-9488","score":0.08216,"percentile":0.94883,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vwqq-5vrc-xw9h","url":"https://osv.dev/vulnerability/GHSA-vwqq-5vrc-xw9h","summary":"Improper validation of certificate with host mismatch in Apache Log4j SMTP appender","modified":"2026-06-09T10:45:14.190237393Z","packages":[{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j","purl":"pkg:maven/org.apache.logging.log4j/log4j","ranges":[">=2.13.0 <2.13.2"],"fixed":["2.13.2"]},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ranges":[">=2.13.0 <2.13.2"],"fixed":["2.13.2"]},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j","purl":"pkg:maven/org.apache.logging.log4j/log4j","ranges":[">=2.4.0 <2.12.3"],"fixed":["2.12.3"]},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j","purl":"pkg:maven/org.apache.logging.log4j/log4j","ranges":["<2.3.2"],"fixed":["2.3.2"]},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ranges":[">=2.4.0 <2.12.3"],"fixed":["2.12.3"]},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ranges":["<2.3.2"],"fixed":["2.3.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}