What is the CVSS score of CVE-2020-9488?

CVE-2020-9488 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2020-9488?

Yes, a patch is available for CVE-2020-9488. Update the affected software to the latest version immediately.

Debian Linux CVE-2020-9488

LOW

Improper Certificate Validation (CWE-295)

2020-04-27 security@apache.org

Apache Information Disclosure Debian Oracle Debian Linux Peoplesoft Enterprise Peopletools Utilities Framework Weblogic Server Communications Application Session Controller Communications Billing And Revenue Management Communications Services Gatekeeper Financial Services Analytical Applications Infrastructure Financial Services Institutional Performance Analytics Financial Services Market Risk Measurement And Management Financial Services Price Creation And Discovery Insurance Insbridge Rating And Underwriting Policy Automation Policy Automation Connector For Siebel Policy Automation For Mobile Devices Retail Customer Management And Segmentation Foundation Siebel Ui Framework Storagetek Acsls Jd Edwards World Security Storagetek Tape Analytics Sw Tool Retail Advanced Inventory Planning Retail Eftlink Retail Xstore Point Of Service Flexcube Private Banking Financial Services Retail Customer Analytics Insurance Policy Administration J2Ee Primavera Unifier Communications Unified Inventory Management Data Integrator Insurance Rules Palette Communications Offline Mediation Controller Retail Order Broker Cloud Service Health Sciences Information Manager Retail Integration Bus Flexcube Core Banking Log4J Enterprise Manager For Peoplesoft Retail Predictive Application Server Reload4J Communications Eagle Ftp Table Base Retrieval Oracle Goldengate Application Adapters Retail Assortment Planning Retail Bulk Data Integration Retail Insights Cloud Service Suite Siebel Apps Marketing Spatial And Graph Qos

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 27, 2020 - 16:15 cve.org

LOW 3.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

598 maven packages depend on org.apache.logging.log4j:log4j-core (254 direct, 347 indirect)

Ecosystem-wide dependent count for version 2.13.0.

DescriptionCVE.org

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

AnalysisAI

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.

Technical ContextAI

This vulnerability is classified under CWE-295. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 Affected products include: Apache Log4J, Oracle Communications Application Session Controller, Oracle Communications Billing And Revenue Management, Oracle Communications Eagle Ftp Table Base Retrieval, Oracle Communications Offline Mediation Controller.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.