Low severity · published Apr 27, 2020
CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
3.7
CVSS
8.2%
EPSS
No
On KEV
Description
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.2% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Log4j · Apache
2.0 before 2.3.2; 2.4 before 2.12.3; 2.13.0 before 2.13.2 · source: NVD
WS
WebLogic Server · Oracle
10.3.6.0.0 · source: NVD
CA
Communications Application Session Controller · Oracle
3.9m0p1 · source: NVD
CB
Communications Billing And Revenue Management · Oracle
7.5.0.23.0; 12.0.0.3.0 · source: NVD
CE
Communications Eagle Ftp Table Base Retrieval · Oracle
4.5 · source: NVD
CO
Communications Offline Mediation Controller · Oracle
12.0.0.3.0 · source: NVD
CS
Communications Services Gatekeeper · Oracle
7.0 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.3.0; 7.4.0 · source: NVD
DI
Data Integrator · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
DL
Debian Linux · Debian
9.0; 10.0; 11.0 · source: NVD
EM
Enterprise Manager For Peoplesoft · Oracle
13.4.1.1 · source: NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.6.0.0 through 8.1.0.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9488
Issue Tracking
https://issues.apache.org/jira/browse/LOG4J2-2819
lists.apache.org
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a%40%3Cjira.kafka.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05%40%3Cdev.zookeeper.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881%40%3Cissues.hive.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f%40%3Cissues.hive.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
More from Log4j
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.0
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…