CVE-2019-1084

6.5MEDIUM

Key Information:

Vendor
Microsoft
Status
Microsoft Exchange Server
Microsoft Outlook
Microsoft Office
Microsoft Lync
Vendor
CVE Published:
15 July 2019

Summary

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

Affected Version(s)

Mail and Calendar = unspecified

Microsoft Exchange Server 2010 Service Pack 3

Microsoft Exchange Server 2013 Cumulative Update 23

References

https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.