Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

GHSA-vwqq-5vrc-xw9h · CVE-2020-9488

Published Jun 5, 2020 · Modified Jun 9, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

References

3.7 / 10

LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Packages

Maven/org.apache.logging.log4j:log4j

Fix 2.12.3, 2.13.2, 2.3.2

Introduced 0, 2.13.0, 2.4.0

41 affected versions

2.02.0-alpha12.0-alpha22.0-beta12.0-beta22.0-beta32.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.1 +21 more

Maven/org.apache.logging.log4j:log4j-core

Fix 2.12.3, 2.13.2, 2.3.2

Introduced 0, 2.13.0, 2.4.0

41 affected versions

2.02.0-alpha12.0-alpha22.0-beta12.0-beta22.0-beta32.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.1 +21 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Description

References

More Maven vulnerabilities

Start Securing