Information Disclosure Vulnerability in Microsoft Exchange by Microsoft

CVE-2019-1084

Summary

An information disclosure vulnerability exists in Microsoft Exchange that permits the creation of entities with non-printable characters in their display names. This flaw can be exploited by an authenticated attacker who may create such entities which then remain hidden during conversations. The security update resolves this issue by implementing validation on display names during their creation in Microsoft Exchange, ensuring that invalid display names are rendered accurately in Microsoft Outlook clients.

References