CVE-2019-1084

Published Jul 15, 2019

Last updated 5 years ago

Overview

Description: An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
Source: secure@microsoft.com
NVD status: Analyzed

Risk scores

CVSS 3.0

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 4
Impact score: 2.9
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-200

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:exchange_server:2010:sp2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "176D85C7-2076-4B2E-819D-256C8B84F393"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DA166F2A-D83B-4D50-AD0B-668D813E0585"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "56728785-188C-470A-9692-E6C7235109CA"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CCF101BE-27FD-4E2D-A694-C606BD3D1ED7"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4DF5BDB5-205D-4B64-A49A-0152AFCF4A13"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "996163E7-6F3F-4D3B-AEA4-62A7F7E1F54D"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8B854E18-7CB0-43F7-9EBF-E356FA176B2F"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:lync_basic:2013:sp1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F16F35C0-6A31-4C2E-B3BC-DCD926AF789E"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:mail_and_calendar:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FE9BA758-AB84-49F7-A5C5-52FBFDE3D3AA"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "081DE1E3-4622-4C32-8B9C-9AEC1CD20638"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "120690A6-E0A1-4E36-A35A-C87109ECC064"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E0B3B0BC-C7C6-4687-AD72-DCA29FF9AE3A"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A1A868C4-0A58-4660-9492-1BADD99D8E59"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FF177984-A906-43FA-BF60-298133FBBD6B"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*",
            "vulnerable": true,
            "matchCriteriaId": "40961B9E-80B6-42E0-A876-58B3CE056E4E"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CA035812-F35A-43F1-9A8D-EE02201AA10A"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:outlook:-:*:*:*:*:iphone_os:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7AC3A2C4-4E11-4159-9255-8E7F34270D81"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D7B6DF1E-0DDA-4809-B216-7CEFE0A53E2B"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E2B1657C-0FF4-461A-BE2A-641275C4B0A0"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:android:*:*",
            "vulnerable": true,
            "matchCriteriaId": "59672376-B1B0-4E97-AFD5-852314A6A836"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D499807D-91F3-447D-B9F0-D612898C9339"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:skype_for_business_basic:2016:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "525DB97A-C93C-45BC-B275-E6EBE7DE8788"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Social media

Configurations

References