CVE-2020-9488

3.7 lowEPSS 8.2%

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 8.2% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2020-04-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:log4j
debian:debian_linux
oracle:communications_application_session_controller
oracle:communications_billing_and_revenue_management
oracle:communications_eagle_ftp_table_base_retrieval
oracle:communications_offline_mediation_controller
oracle:communications_services_gatekeeper
oracle:communications_unified_inventory_management
oracle:data_integrator
oracle:enterprise_manager_for_peoplesoft
oracle:financial_services_analytical_applications_infrastructure
oracle:financial_services_institutional_performance_analytics
oracle:financial_services_market_risk_measurement_and_management
oracle:financial_services_price_creation_and_discovery
oracle:financial_services_retail_customer_analytics
oracle:flexcube_core_banking
oracle:flexcube_private_banking
oracle:health_sciences_information_manager
oracle:insurance_insbridge_rating_and_underwriting
oracle:insurance_policy_administration_j2ee
oracle:insurance_rules_palette
oracle:jd_edwards_world_security
oracle:oracle_goldengate_application_adapters
oracle:peoplesoft_enterprise_peopletools
oracle:policy_automation
oracle:policy_automation_connector_for_siebel
oracle:policy_automation_for_mobile_devices
oracle:primavera_unifier
oracle:retail_advanced_inventory_planning
oracle:retail_assortment_planning
oracle:retail_bulk_data_integration
oracle:retail_customer_management_and_segmentation_foundation
oracle:retail_eftlink
oracle:retail_insights_cloud_service_suite
oracle:retail_integration_bus
oracle:retail_order_broker_cloud_service
oracle:retail_predictive_application_server
oracle:retail_xstore_point_of_service
oracle:siebel_apps_-_marketing
oracle:siebel_ui_framework
oracle:spatial_and_graph
oracle:storagetek_acsls
oracle:storagetek_tape_analytics_sw_tool
oracle:utilities_framework
oracle:weblogic_server
qos:reload4j

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-vwqq-5vrc-xw9h	Maven	org.apache.logging.log4j:log4j	>=2.13.0 <2.13.2	2.13.2
GHSA-vwqq-5vrc-xw9h	Maven	org.apache.logging.log4j:log4j-core	>=2.13.0 <2.13.2	2.13.2
GHSA-vwqq-5vrc-xw9h	Maven	org.apache.logging.log4j:log4j	>=2.4.0 <2.12.3	2.12.3
GHSA-vwqq-5vrc-xw9h	Maven	org.apache.logging.log4j:log4j	<2.3.2	2.3.2
GHSA-vwqq-5vrc-xw9h	Maven	org.apache.logging.log4j:log4j-core	>=2.4.0 <2.12.3	2.12.3
GHSA-vwqq-5vrc-xw9h	Maven	org.apache.logging.log4j:log4j-core	<2.3.2	2.3.2

References

Check your stack JSON