CVE-2019-1218: microsoft outlook Cross-site Scripting
Vulnerability summary
CVE-2019-1218 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in microsoft outlook. EPSS estimates a 3.88% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities.
Timeline
- 14-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook iOS parses specially crafted email messages.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.88%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.88% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft2 products
- outlookna
- outlook for ios< publication
1 vendor · 2 products
References
1 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1218X Refsource MISCPatchVendor Advisory