Information disclosure in Microsoft Exchange Server
CVE-2019-1084
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
Vulnerability class: Information Disclosure
EPSS: 0.053 (92.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Microsoft Exchange_server — versions 2010, 2013, 2016
- Microsoft Lync — versions 2013
- Microsoft Lync_basic — versions 2013
- Microsoft Mail And Calendar — versions unspecified
- Microsoft Mail_and_calendar
- Microsoft Exchange Server — versions 2010 Service Pack 3
- Microsoft Exchange Server 2013 — versions Cumulative Update 23
- Microsoft Exchange Server 2016 — versions Cumulative Update 12, Cumulative Update 13
- Microsoft Exchange Server 2019 — versions Cumulative Update 1, Cumulative Update 2
- Microsoft Lync — versions 2013 Service Pack 1 (32-bit), 2013 Service Pack 1 (64-bit)
Weakness classification (CWE)
References
- secure@microsoft.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1084?
- CVE-2019-1084 is a medium-severity vulnerability in Microsoft Exchange Server, classified under Information Disclosure. CVSS score: 6.5/10. Published 2019-07-15.
- How severe is CVE-2019-1084?
- Medium severity. CVSS v3 base score is 6.5 out of 10.