CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
3.7 LowPublic exploitFix available
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
8.22%Down 13.4 points since Apr 14, 2021
What each source reports
NVD Score used
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
- Record
CVE-2020-9488- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
- Record
CVE-2020-9488- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2020-0518
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
- Record
EUVD-2020-0518- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vwqq-5vrc-xw9h
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
- Record
GHSA-vwqq-5vrc-xw9h- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
- Record
CVE-2020-9488- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
- Record
DEBIAN-CVE-2020-9488- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-vwqq-5vrc-xw9h
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
- Record
GHSA-vwqq-5vrc-xw9h- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVRHSA-2020:3817
Red Hat Security Advisory: AMQ Clients 2.8.0 Release
- Record
RHSA-2020:3817- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
- Record
UBUNTU-CVE-2020-9488- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11025-1 No score
log4j-2.13.2-1.9 on GA media
These are all security issues fixed in the log4j-2.13.2-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11025-1- Updated
- 2026-11-02
Affected products
- apache log4j
- apache software foundation log4j
- debian linux
- oracle communications application session controller
- oracle communications billing and revenue management
- oracle communications eagle ftp table base retrieval
- oracle communications offline mediation controller
- oracle communications services gatekeeper
- oracle communications unified inventory management
- oracle data integrator
- oracle enterprise manager for peoplesoft
- oracle financial services analytical applications infrastructure
Show 35 moreShow less
- oracle financial services institutional performance analytics
- oracle financial services market risk measurement and management
- oracle financial services price creation and discovery
- oracle financial services retail customer analytics
- oracle flexcube core banking
- oracle flexcube private banking
- oracle health sciences information manager
- oracle insurance insbridge rating and underwriting
- oracle insurance policy administration j2ee
- oracle insurance rules palette
- oracle jd edwards world security
- oracle goldengate application adapters
- oracle peoplesoft enterprise peopletools
- oracle policy automation
- oracle policy automation connector for siebel
- oracle policy automation for mobile devices
- oracle primavera unifier
- oracle retail advanced inventory planning
- oracle retail assortment planning
- oracle retail bulk data integration
- oracle retail customer management and segmentation foundation
- oracle retail eftlink
- oracle retail insights cloud service suite
- oracle retail integration bus
- oracle retail order broker cloud service
- oracle retail predictive application server
- oracle retail xstore point of service
- oracle siebel apps - marketing
- oracle siebel ui framework
- oracle spatial and graph
- oracle storagetek acsls
- oracle storagetek tape analytics sw tool
- oracle utilities framework
- oracle weblogic server
- qos reload4j
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4jMaven |
2.13.0 up to 2.13.2 | 2.13.2 |
org.apache.logging.log4j:log4j-coreMaven |
2.13.0 up to 2.13.2 | 2.13.2 |
org.apache.logging.log4j:log4jMaven |
2.4.0 up to 2.12.3 | 2.12.3 |
org.apache.logging.log4j:log4jMaven |
before 2.3.2 | 2.3.2 |
org.apache.logging.log4j:log4j-coreMaven |
2.4.0 up to 2.12.3 | 2.12.3 |
org.apache.logging.log4j:log4j-coreMaven |
before 2.3.2 | 2.3.2 |
apache-log4j2Debian:12 |
before 2.13.3-1 | 2.13.3-1 |
apache-log4j2Debian:13 |
before 2.13.3-1 | 2.13.3-1 |
apache-log4j2Debian:14 |
before 2.13.3-1 | 2.13.3-1 |
apache-log4j2Debian:9 |
before 2.12.3-0+deb9u1, plus listed versions 2.10.0-12.10.0-22.11.1-12.11.1-22.11.2-1 Show 4 moreShow less2.7-22.7-2+deb9u12.8.2-12.8.2-2 |
2.12.3-0+deb9u1 |
Show 60 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4jMaven |
2.13.0 up to 2.13.2, plus listed versions 2.13.1 |
2.13.2 |
org.apache.logging.log4j:log4j-coreMaven |
2.13.0 up to 2.13.2, plus listed versions 2.13.1 |
2.13.2 |
org.apache.logging.log4j:log4jMaven |
2.4.0 up to 2.12.3, plus listed versions 2.10.02.11.02.11.12.11.22.12.0 Show 14 moreShow less2.12.12.12.22.42.4.12.52.62.6.12.6.22.72.82.8.12.8.22.9.02.9.1 |
2.12.3 |
org.apache.logging.log4j:log4jMaven |
before 2.3.2, plus listed versions 2.02.0-alpha12.0-alpha22.0-beta12.0-beta2 Show 15 moreShow less2.0-beta32.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.22.32.3.1 |
2.3.2 |
org.apache.logging.log4j:log4j-coreMaven |
2.4.0 up to 2.12.3, plus listed versions 2.10.02.11.02.11.12.11.22.12.0 Show 14 moreShow less2.12.12.12.22.42.4.12.52.62.6.12.6.22.72.82.8.12.8.22.9.02.9.1 |
2.12.3 |
org.apache.logging.log4j:log4j-coreMaven |
before 2.3.2, plus listed versions 2.02.0-alpha12.0-alpha22.0-beta12.0-beta2 Show 15 moreShow less2.0-beta32.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.22.32.3.1 |
2.3.2 |
python-qpid-protonRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
python-qpid-proton-docsRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-cppRed Hat:a_mq_clients:2::el6 |
before 0:1.36.0-31.el6_10amq | 0:1.36.0-31.el6_10amq |
qpid-cpp-clientRed Hat:a_mq_clients:2::el6 |
before 0:1.36.0-31.el6_10amq | 0:1.36.0-31.el6_10amq |
qpid-cpp-client-develRed Hat:a_mq_clients:2::el6 |
before 0:1.36.0-31.el6_10amq | 0:1.36.0-31.el6_10amq |
qpid-cpp-client-docsRed Hat:a_mq_clients:2::el6 |
before 0:1.36.0-31.el6_10amq | 0:1.36.0-31.el6_10amq |
qpid-cpp-debuginfoRed Hat:a_mq_clients:2::el6 |
before 0:1.36.0-31.el6_10amq | 0:1.36.0-31.el6_10amq |
qpid-protonRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-proton-cRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-proton-c-develRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-proton-c-docsRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-proton-cppRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-proton-cpp-develRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-proton-cpp-docsRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-proton-debuginfoRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
qpid-proton-testsRed Hat:a_mq_clients:2::el6 |
before 0:0.32.0-1.el6_10 | 0:0.32.0-1.el6_10 |
python-qpid-protonRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
python-qpid-proton-docsRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-cppRed Hat:a_mq_clients:2::el7 |
before 0:1.36.0-31.el7amq | 0:1.36.0-31.el7amq |
qpid-cpp-clientRed Hat:a_mq_clients:2::el7 |
before 0:1.36.0-31.el7amq | 0:1.36.0-31.el7amq |
qpid-cpp-client-develRed Hat:a_mq_clients:2::el7 |
before 0:1.36.0-31.el7amq | 0:1.36.0-31.el7amq |
qpid-cpp-client-docsRed Hat:a_mq_clients:2::el7 |
before 0:1.36.0-31.el7amq | 0:1.36.0-31.el7amq |
qpid-cpp-debuginfoRed Hat:a_mq_clients:2::el7 |
before 0:1.36.0-31.el7amq | 0:1.36.0-31.el7amq |
qpid-protonRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-proton-cRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-proton-c-develRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-proton-c-docsRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-proton-cppRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-proton-cpp-develRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-proton-cpp-docsRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-proton-debuginfoRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
qpid-proton-testsRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
rubygem-qpid_protonRed Hat:a_mq_clients:2::el7 |
before 0:0.32.0-2.el7 | 0:0.32.0-2.el7 |
nodejs-rheaRed Hat:a_mq_clients:2::el8 |
before 0:1.0.24-1.el8 | 0:1.0.24-1.el8 |
python-qpid-proton-docsRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
python3-qpid-protonRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
python3-qpid-proton-debuginfoRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-protonRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-cRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-c-debuginfoRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-c-develRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-c-docsRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-cppRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-cpp-debuginfoRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-cpp-develRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-cpp-docsRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-debuginfoRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-debugsourceRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
qpid-proton-testsRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
rubygem-qpid_protonRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
rubygem-qpid_proton-debuginfoRed Hat:a_mq_clients:2::el8 |
before 0:0.32.0-2.el8 | 0:0.32.0-2.el8 |
apache-log4j2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2-12.4-12.4-22.4-2ubuntu0.1~esm1 |
None known |
apache-log4j2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.8.2-12.8.2-22.10.0-12.10.0-22.10.0-2ubuntu0.12.12.4-0ubuntu0.1 |
None known |
apache-log4j2Ubuntu:20.04:LTS |
before 2.16.0-0.20.04.1, plus listed versions 2.11.1-22.11.2-12.15.0-0.20.04.1 |
2.16.0-0.20.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | arsalanraja987/java-log4j-cve-2020-9488 | 2025-07-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-9488 is a low vulnerability (CVSS 3.7) in Apache Log4j, published April 27, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.22%, the 94th percentile. Fixed in org.apache.logging.log4j:log4j 2.13.2.
References
lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846%40%3Cissues.zookeeper.apache.org%3E
Show 114 moreShow less
oracle.com/security-alerts/cpujul2020.html
issues.apache.org/jira/browse/LOG4J2-2819
security.netapp.com/advisory/ntap-20200504-0003
debian.org/security/2021/dsa-5020
lists.debian.org/debian-lts-announce/2021/12/msg00017.html
nvd.nist.gov/vuln/detail/CVE-2020-9488
github.com/advisories/GHSA-vwqq-5vrc-xw9h
security-tracker.debian.org/tracker/CVE-2020-9488
access.redhat.com/errata/RHSA-2020:3817
bugzilla.redhat.com/show_bug.cgi?id=1821315
issues.redhat.com/browse/ENTMQCL-1987
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3817.json
cve.org/CVERecord?id=CVE-2020-9488
ubuntu.com/security/CVE-2020-9488
openwall.com/lists/oss-security/2020/04/25/1
gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=6851b5083ef9610bae320bf07e1f24d2aa08851b
suse.com/security/cve/CVE-2019-17571