CVE-2020-9488
LOW 3.7EPSS 8.2%
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
- Affected
- Apache · Apache Log4j
- CVSS v3.1 NVD
- 3.7 LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N - EPSS
- 8.22% chance of exploitation in the next 30 days, 95th percentile
- Published
- 2020-04-27
- Updated
- 2026-05-29
Proof-of-concept exploits (1)
- arsalanraja987/java-log4j-cve-2020-94880★ · 2025-07-07
Security advisories
- https://issues.apache.org/jira/browse/LOG4J2-2819
- https://lists.debian.org/debian-lts-announce/2021/12/msg00017.html
- https://security.netapp.com/advisory/ntap-20200504-0003
- https://www.debian.org/security/2021/dsa-5020
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- advisories/GHSA-vwqq-5vrc-xw9h