CVE-2020-9488

CWE-295 — Improper Certificate Validation18 documents10 sources
Severity
3.7LOW
EPSS
0.0%
top 91.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
47
Apache Apache Log4jApache Log4jQOS Reload4j+44 more
Timeline
PublishedApr 27
Latest updateApr 15

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages48 packages

▶NVDapache/log4j2.0 — 2.3.2+2
▶CVEListV5apache/apache_log4jlog4j-core — 2.12.3+1
▶Mavenorg.apache.logging.log4j:log4j2.13.0 — 2.13.2+2
▶Mavenorg.apache.logging.log4j:log4j-core2.13.0 — 2.13.2+2
▶Debianapache-log4j2< 2.13.3-1+3

Also affects: Debian Linux 10.0, 11.0, 9.0

Patches

Patch: issues.apache.org ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
OSV
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender↗2020-06-05
▶
GHSA
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender↗2020-06-05
▶
OSV
CVE-2020-9488: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender↗2020-04-27
▶
CVEList
CVE-2020-9488: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender↗2020-04-27
▶

💥Exploits & PoCs

1
Exploit-DB
ManageEngine Applications Manager 13 - 'MenuHandlerServlet' SQL Injection↗2020-07-26
▶

📋Vendor Advisories

9
Oracle
Oracle Oracle Systems Risk Matrix: Software (Apache Log4j) — CVE-2020-9488↗2022-04-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Logging (Apache Log4j) — CVE-2020-9488↗2021-10-15
▶
Oracle
Oracle Oracle JD Edwards Risk Matrix: World Software Security (Apache Log4j) — CVE-2020-9488↗2021-04-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Install, config, upgrade (Apache Log4j) — CVE-2020-9488↗2021-01-15
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: Billing Operation Center and Oracle Communication Billing Care (Apache Log4j) — CVE-2020-9488↗2020-10-15
▶

💬Community

3
Bugzilla
CVE-2020-9488 log4j12: log4j: improper validation of certificate with host mismatch in SMTP appender [fedora-all]↗2020-05-04
▶
Bugzilla
CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender [fedora-all]↗2020-05-04
▶
Bugzilla
CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender↗2020-05-04
▶