CVE-2019-1084: microsoft exchange_server

Vulnerability summary

CVE-2019-1084 is a medium (CVSS 6.5) vulnerability in microsoft exchange_server. EPSS estimates a 5.33% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities.

Timeline

1. 15-07-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.