CVE-2020-9488

Published: Apr 27, 2020Modified: Jun 17, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Vulnerable Software	Affected Versions
Apache Log4j	From 2.0 to 2.3.2
Apache Log4j	From 2.13.0 to 2.13.2
Apache Log4j	From 2.4 to 2.12.3

Vulnerable Software	Affected Versions
Oracle Communications Application Session Controller	Version 3.9m0p1
Oracle Communications Billing And Revenue Management	Version 12.0.0.3.0
Oracle Communications Billing And Revenue Management	Version 7.5.0.23.0
Oracle Communications Eagle Ftp Table Base Retrieval	Version 4.5
Oracle Communications Offline Mediation Controller	Version 12.0.0.3.0
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Communications Unified Inventory Management	Version 7.3.0
Oracle Communications Unified Inventory Management	Version 7.4.0
Oracle Data Integrator	Version 12.2.1.3.0
Oracle Data Integrator	Version 12.2.1.4.0
Oracle Enterprise Manager For Peoplesoft	Version 13.4.1.1
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6.0.0 to 8.1.0.0.0
Oracle Financial Services Institutional Performance Analytics	Version 8.0.6
Oracle Financial Services Institutional Performance Analytics	Version 8.1.0
Oracle Financial Services Institutional Performance Analytics	Version 8.7.0
Oracle Financial Services Market Risk Measurement And Management	Version 8.0.6
Oracle Financial Services Market Risk Measurement And Management	Version 8.0.8
Oracle Financial Services Market Risk Measurement And Management	Version 8.1.0
Oracle Financial Services Price Creation And Discovery	Version 8.0.6
Oracle Financial Services Price Creation And Discovery	Version 8.0.7
Oracle Financial Services Retail Customer Analytics	Version 8.0.6
Oracle Flexcube Core Banking	From 11.5.0 to 11.7.0
Oracle Flexcube Core Banking	Version 5.2.0
Oracle Flexcube Private Banking	Version 12.0.0
Oracle Flexcube Private Banking	Version 12.1.0
Oracle Health Sciences Information Manager	Version 3.0.1
Oracle Insurance Insbridge Rating And Underwriting	From 5.0.0.0 to 5.6.0.0
Oracle Insurance Insbridge Rating And Underwriting	Version 5.6.1.0
Oracle Insurance Policy Administration J2ee	Version 10.2.0.37
Oracle Insurance Policy Administration J2ee	Version 10.2.4.12
Oracle Insurance Policy Administration J2ee	Version 11.0.2.25
Oracle Insurance Policy Administration J2ee	Version 11.1.0.15
Oracle Insurance Policy Administration J2ee	Version 11.2.0.26
Oracle Insurance Rules Palette	Version 10.2.0.37
Oracle Insurance Rules Palette	Version 10.2.4.12
Oracle Insurance Rules Palette	Version 11.0.2.25
Oracle Insurance Rules Palette	Version 11.1.0.15
Oracle Insurance Rules Palette	Version 11.2.0.26
Oracle Jd Edwards World Security	Version a9.4
Oracle Oracle Goldengate Application Adapters	Version 19.1.0.0.0
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Policy Automation	From 12.2.0 to 12.2.20
Oracle Policy Automation Connector For Siebel	Version 10.4.6
Oracle Policy Automation For Mobile Devices	From 12.2.0 to 12.2.20
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Retail Advanced Inventory Planning	Version 14.1
Oracle Retail Assortment Planning	Version 15.0.3.0
Oracle Retail Assortment Planning	Version 16.0.3.0
Oracle Retail Bulk Data Integration	Version 15.0.3.0
Oracle Retail Bulk Data Integration	Version 16.0.3.0
Oracle Retail Customer Management And Segmentation Foundation	Version 16.0
Oracle Retail Customer Management And Segmentation Foundation	Version 17.0
Oracle Retail Customer Management And Segmentation Foundation	Version 18.0
Oracle Retail Customer Management And Segmentation Foundation	Version 19.0
Oracle Retail Eftlink	Version 15.0.2
Oracle Retail Eftlink	Version 16.0.3
Oracle Retail Eftlink	Version 17.0.2
Oracle Retail Eftlink	Version 18.0.1
Oracle Retail Eftlink	Version 19.0.1
Oracle Retail Insights Cloud Service Suite	Version 19.0
Oracle Retail Integration Bus	Version 14.1
Oracle Retail Integration Bus	Version 15.0
Oracle Retail Integration Bus	Version 16.0
Oracle Retail Order Broker Cloud Service	Version 16.0
Oracle Retail Order Broker Cloud Service	Version 18.0
Oracle Retail Order Broker Cloud Service	Version 19.0
Oracle Retail Order Broker Cloud Service	Version 19.1
Oracle Retail Order Broker Cloud Service	Version 19.2
Oracle Retail Order Broker Cloud Service	Version 19.3
Oracle Retail Predictive Application Server	Version 14.1.3.0
Oracle Retail Predictive Application Server	Version 15.0.3.0
Oracle Retail Predictive Application Server	Version 16.0.3.0
Oracle Retail Xstore Point Of Service	Version 15.0.4
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Retail Xstore Point Of Service	Version 19.0.2
Oracle Siebel Apps Marketing	Up to 21.9
Oracle Siebel Ui Framework	Up to 21.2
Oracle Spatial And Graph	Version 12.2.0.1
Oracle Spatial And Graph	Version 18c
Oracle Spatial And Graph	Version 19c
Oracle Storagetek Acsls	Version 8.5.1
Oracle Storagetek Tape Analytics Sw Tool	Version 2.3.1
Oracle Utilities Framework	From 4.3.0.1.0 to 4.3.0.6.0
Oracle Utilities Framework	Version 2.2.0.0.0
Oracle Utilities Framework	Version 4.2.0.2.0
Oracle Utilities Framework	Version 4.2.0.3.0
Oracle Utilities Framework	Version 4.4.0.0.0
Oracle Utilities Framework	Version 4.4.0.2.0
Oracle Weblogic Server	Version 10.3.6.0.0

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 9.0

CVE-2020-9488

Description

Affected (101)

Related CWEs

References (98)

Timeline