QSearchQSearch

CVE-2020-9488

3.7 LOW

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Published: 2020-04-27 · Last updated: 2026-05-29

Severity and scoring

CVSS
3.7 LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
CWE-295

Affected products

VendorProduct
apachecommunications_application_session_controller, communications_billing_and_revenue_management, communications_eagle_ftp_table_base_retrieval
debiancommunications_application_session_controller, communications_billing_and_revenue_management, communications_eagle_ftp_table_base_retrieval
oraclecommunications_application_session_controller, communications_billing_and_revenue_management, communications_eagle_ftp_table_base_retrieval
qoscommunications_application_session_controller, communications_billing_and_revenue_management, communications_eagle_ftp_table_base_retrieval

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-34905 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer (6.5 MEDIUM)
  • CVE-2026-34031 — Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer (6.5 MEDIUM)
  • CVE-2026-33582 — Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer (6.5 MEDIUM)
  • CVE-2026-25699 — Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer (6.1 MEDIUM)
  • CVE-2026-25688 — Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer (6.1 MEDIUM)

Same CWE

  • CVE-2026-53475 — A flaw was found in assisted-migration-agent (9.3 CRITICAL)
  • CVE-2026-9758 — Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered tru... (7.3 HIGH)
  • CVE-2026-41714 — Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(... (4.0 MEDIUM)
  • CVE-2026-42769 — Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (... (5.3 MEDIUM)
  • CVE-2026-50752 — A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a... (7.4 HIGH)