vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-9488

LOW
3.7
CVSS Score
Published: April 27, 2020 at 03:36 PM UTC
Updated: June 17, 2026 at 03:28 AM UTC
46 products affected across 4 vendorsDebian LinuxPeopleSoft Enterprise PeopleToolsWebLogic Server

Using Apache Log4j by Apache?

Get instant alerts when new vulnerabilities affect Apache Log4j - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW3.7
Exploit prediction
EPSS 8%
SSVC
No known exploit

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Log4j· Apachemaven
95%
2.0 ≤ v < 2.3.22.13.0 ≤ v < 2.13.22.4 ≤ v < 2.12.3log4j-core ≤ v < 2.12.32.13.0log4j-core
Affected range stops below 2.12.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.13.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.3.2, so it looks safe — our inference, not a vendor statement
Debian Linux· Debiandrupal
95%
10.011.09.0
Communications Application Session Controller· Oracledrupal
95%
3.9m0p1
Communications Billing and Revenue Management· Oracledrupal
95%
12.0.0.3.07.5.0.23.0
Communications Eagle FTP Table Base Retrieval· Oracle
95%
4.5
Communications Offline Mediation Controller· Oracle
95%
12.0.0.3.0
Communications Services Gatekeeper· Oracledrupal
95%
7.0
Communications Unified Inventory Management· Oracle
95%
7.3.07.4.0
Data Integrator· Oracle
95%
12.2.1.3.012.2.1.4.0
Enterprise Manager for Peoplesoft· Oracle
95%
13.4.1.1

References (49)

x_refsource_CONFIRMIssue TrackingMitigationPatchVendor Advisory
Source: [email protected]
https://issues.apache.org/jira/browse/LOG4J2-2819
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a%40%3Cjira.kafka.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05%40%3Cdev.zookeeper.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881%40%3Cissues.hive.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f%40%3Cissues.hive.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6%40%3Cdev.zookeeper.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04%40%3Cissues.hive.apache.org%3E

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

3.7LOWCISA-ADP
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-295

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card