CVE-2019-1084
- State
- Published
- Severity
- Not scored
- Published
- Jul 15, 2019
- Updated
- Aug 4, 2024
- Reserved
- Nov 26, 2018
Description
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Microsoft Exchange ServerMicrosoft |
|
Microsoft OutlookMicrosoft |
|
Microsoft OfficeMicrosoft |
|
Microsoft LyncMicrosoft |
|
Microsoft Lync BasicMicrosoft |
|
Microsoft Outlook for AndroidMicrosoft |
|
Skype for BusinessMicrosoft |
|
Skype for Business BasicMicrosoft |
|
Office 365 ProPlusMicrosoft |
|
Microsoft Exchange Server 2016Microsoft |
|
Microsoft Exchange Server 2019Microsoft |
|
Microsoft Exchange Server 2013Microsoft |
|
Mail and CalendarMicrosoft |
|
Outlook for iOSMicrosoft |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.