CVE-2019-1105: microsoft microsoft outlook for android Cross-site Scripting
Vulnerability summary
CVE-2019-1105 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in microsoft microsoft outlook for android. EPSS estimates a 1.82% chance of exploitation in the next 30 days, higher than 78.3% of scored vulnerabilities.
Timeline
- 29-07-2019PublishedVulnerability first disclosed.
- 20-05-2025Last modifiedVulnerability information updated.
Description
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.82%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.82% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft1 product
- microsoft outlook for android≥ 1.0, < Publication
1 vendor · 1 product
References
2 links
msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1105Vendor Advisory- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1105X Refsource MISCX TransferredPatchVendor Advisory