6.5

CVE-2019-1084

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Exchange Server Version 2010 Update sp2
Microsoft ≫ Exchange Server Version 2013 Update cumulative_update_23
Microsoft ≫ Exchange Server Version 2016 Update cumulative_update_1
Microsoft ≫ Exchange Server Version 2016 Update cumulative_update_12
Microsoft ≫ Exchange Server Version 2016 Update cumulative_update_13
Microsoft ≫ Exchange Server Version 2016 Update cumulative_update_2
Microsoft ≫ Lync Version 2013 Update sp1
Microsoft ≫ Lync Basic Version 2013 Update sp1
Microsoft ≫ Office Version 2010 Update sp2
Microsoft ≫ Office Version 2013 Update sp1
Microsoft ≫ Office Version 2016
Microsoft ≫ Office Version 2016 SwPlatform mac_os
Microsoft ≫ Office Version 2019
Microsoft ≫ Office Version 2019 SwPlatform macos
Microsoft ≫ Outlook Version - SwPlatform iphone_os
Microsoft ≫ Outlook Version 2013 Update sp1
Microsoft ≫ Outlook Version 2016
Microsoft ≫ Outlook Version 2016 SwPlatform android
Microsoft ≫ Skype For Business Version 2016
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.33% 0.916
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1084
Patch
Vendor Advisory