Vulnerability · NVD

CVE-2019-1084

MEDIUM 6.5 Published on 2019-07-15

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

Attack vector : Network No user interaction

Show raw CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS 5.33% above median percentile 91.9%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Microsoft Outlook iOS com.microsoft.Office.Outlook

Affected — Fixed in — Latest tracked 5.2630.0 undetermined
Microsoft Outlook Android com.microsoft.office.outlook

Affected — Fixed in — Latest tracked 5.2630.0 undetermined

NVD references 9 distinct products for this CVE — only those tracked by Scout (mobile and desktop catalog apps) are listed above. Libraries, servers and out-of-scope products do not appear here. Full list on NVD ↗

Vulnerable CPE configurations (2)

Vendor	Product	Platform	Versions	CPE 2.3 URI
microsoft	outlook iOS	iOS	—	cpe:2.3:a:microsoft:outlook:-:::::iphone_os::
microsoft	outlook Android	Android	—	cpe:2.3:a:microsoft:outlook:2016:::::android::

View on NVD ↗ Advisory · portal.msrc.microsoft.com