Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-9488

20
FAUCET Score

CVE-2020-9488 is a low-severity vulnerability in Apache Log4j's SMTP appender, affecting Apache, Debian, Oracle, and QOS products. It involves improper certificate validation, allowing a man-in-the-middle attack to intercept SMTPS connections and potentially leak log messages. The CVSS score is 3.7, indicating a network attack vector with high attack complexity and a low impact on confidentiality. There is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, though it has received some community discussion and media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.0, < 2.3.2CPE matchmatch criteria
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
>= 2.4, < 2.12.3CPE matchmatch criteria
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
>= 2.13.0, < 2.13.2CPE matchmatch criteria
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
3.9m0p1CPE matchmatch criteria
cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p1:*:*:*:*:*:*:*
7.5.0.23.0CPE matchmatch criteria
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

3.7LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
8.10%
Probability of exploitation in next 30 days
EPSS Percentile
94.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0810 is in the 94th percentile among its peer group of 1,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (33)

mavenpatch availablevia ghsa
Product: org.apache.logging.log4j:log4jFixed in: 2.13.2
mavenpatch availablevia ghsa
Product: org.apache.logging.log4j:log4j-coreFixed in: 2.13.2
mavenpatch availablevia ghsa
Product: org.apache.logging.log4j:log4jFixed in: 2.12.3
mavenpatch availablevia ghsa
Product: org.apache.logging.log4j:log4jFixed in: 2.3.2
mavenpatch availablevia ghsa
Product: org.apache.logging.log4j:log4j-coreFixed in: 2.12.3
mavenpatch availablevia ghsa
Product: org.apache.logging.log4j:log4j-coreFixed in: 2.3.2
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: AMQ Clients 2.y for RHEL 6Fixed in: qpid-cpp-0:1.36.0-31.el6_10amq
View patch
redhatpatch availablevia redhat_api
Product: AMQ Clients 2.y for RHEL 7Fixed in: qpid-cpp-0:1.36.0-31.el7amq
View patch
redhatpatch availablevia redhat_api
Product: AMQ Clients 2.y for RHEL 7Fixed in: qpid-proton-0:0.32.0-2.el7
View patch
redhatpatch availablevia redhat_api
Product: AMQ Clients 2.y for RHEL 8Fixed in: nodejs-rhea-0:1.0.24-1.el8
View patch
redhatpatch availablevia redhat_api
Product: AMQ Clients 2.y for RHEL 8Fixed in: qpid-proton-0:0.32.0-2.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Data GridFixed in: log4j-core
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Data Grid 7.3.7Fixed in: log4j
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Fuse 7.10Fixed in: log4j-core
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Fuse 7.8.0Fixed in: log4j
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Data Virtualization 6.4.8.SP1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Data Virtualization 6.4.8.SP2
View patch
redhatpatch availablevia redhat_api
Product: RHDM 7.10.0Fixed in: log4j-core
View patch
redhatpatch availablevia redhat_api
Product: RHPAM 7.10.1Fixed in: log4j-core
View patch
redhatpatch availablevia redhat_api
Product: Text-Only RHOARFixed in: log4j
View patch
redhatpatch availablevia redhat_api
Product: Text-Only RHOARFixed in: log4j-core
View patch
redhatpatch availablevia redhat_api
Product: AMQ Clients 2.y for RHEL 6Fixed in: qpid-proton-0:0.32.0-1.el6_10
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat AMQ Broker 7Fixed in: log4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: parfait:0.5/log4j12
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: log4j
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 3.11Fixed in: openshift3/ose-logging-elasticsearch5
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-logging-elasticsearch5
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-metering-hive
redhatvendor investigatingvia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-maven35-log4j12
redhatvendor investigatingvia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-maven36-log4j12
redhatvendor investigatingvia redhat_api
Product: streams for Apache KafkaFixed in: log4j
redhatend of lifevia redhat_api
Product: Red Hat JBoss Web Server 3Fixed in: log4j-eap6

Vendor Advisories (2)

mavenGHSA-vwqq-5vrc-xw9hlow

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Jun 5, 2020
redhatCVE-2020-9488Low

log4j: improper validation of certificate with host mismatch in SMTP appender

Apr 25, 2020

References

issues.apache.org / jira/browse/LOG4J2-2819
Issue TrackingMitigationPatchVendor Advisory
lists.apache.org / thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a%40%3Cjira.kafka.apache.org%3E
lists.apache.org / thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05%40%3Cdev.zookeeper.apache.org%3E
lists.apache.org / thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
lists.apache.org / thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6%40%3Cdev.zookeeper.apache.org%3E
lists.apache.org / thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4%40%3Ctorque-dev.db.apache.org%3E
lists.apache.org / thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98%40%3Cissues.zookeeper.apache.org%3E
lists.apache.org / thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a%40%3Cissues.flink.apache.org%3E
lists.apache.org / thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463%40%3Cjira.kafka.apache.org%3E
lists.apache.org / thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E
lists.apache.org / thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b%40%3Cdev.hive.apache.org%3E
lists.apache.org / thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f%40%3Cdev.hive.apache.org%3E
lists.apache.org / thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695%40%3Cnotifications.zookeeper.apache.org%3E
lists.apache.org / thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220%40%3Cdev.kafka.apache.org%3E
lists.apache.org / thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5%40%3Cnotifications.zookeeper.apache.org%3E
lists.apache.org / thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846%40%3Cissues.zookeeper.apache.org%3E
lists.apache.org / thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1%40%3Cjira.kafka.apache.org%3E
lists.apache.org / thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd%40%3Cissues.zookeeper.apache.org%3E
lists.apache.org / thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40%40%3Cissues.hive.apache.org%3E
lists.apache.org / thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E
lists.apache.org / thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3%40%3Ctorque-dev.db.apache.org%3E
lists.apache.org / thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a%40%3Ctorque-dev.db.apache.org%3E
lists.apache.org / thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701%40%3Cnotifications.zookeeper.apache.org%3E
lists.apache.org / thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
lists.apache.org / thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc%40%3Cissues.zookeeper.apache.org%3E
lists.apache.org / thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604%40%3Ctorque-dev.db.apache.org%3E
lists.apache.org / thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac%40%3Cissues.zookeeper.apache.org%3E
lists.apache.org / thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987%40%3Cgitbox.hive.apache.org%3E
lists.apache.org / thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E
lists.apache.org / thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20%40%3Cdev.kafka.apache.org%3E
lists.apache.org / thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
lists.debian.org / debian-lts-announce/2021/12/msg00017.html
Mailing ListThird Party Advisory
security.netapp.com / advisory/ntap-20200504-0003
Third Party Advisory
debian.org / security/2021/dsa-5020
Third Party Advisory
oracle.com / security-alerts/cpuApr2021.html
PatchThird Party Advisory
oracle.com / security-alerts/cpuapr2022.html
PatchThird Party Advisory
oracle.com / security-alerts/cpujan2021.html
Third Party Advisory
oracle.com / security-alerts/cpujul2020.html
Third Party Advisory
oracle.com / security-alerts/cpuoct2020.html
Third Party Advisory
oracle.com / security-alerts/cpuoct2021.html
PatchThird Party Advisory