CVE-2019-1084 Details
Description
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1084 | CVE | PatchVendor Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1084 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| microsoft exchange server | 2010 sp2 2013 cumulative_update_23 2016 cumulative_update_1 2016 cumulative_update_12 2016 cumulative_update_13 2016 cumulative_update_2 |
CPE
Remediation
| |
| microsoft lync | 2013 sp1 |
CPE
Remediation
| |
| microsoft lync basic | 2013 sp1 |
CPE
Remediation
| |
| microsoft mail and calendar | All versions |
CPE
Remediation
| |
| microsoft office | 2010 sp2 2013 sp1 2016 2019 |
CPE
Remediation
| |
| microsoft office 365 proplus | All versions |
CPE
Remediation
| |
| microsoft outlook | 2013 sp1 2016 |
CPE
Remediation
| |
| microsoft skype for business | 2016 |
CPE
Remediation
| |
| microsoft skype for business basic | 2016 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| May 4, 2020 | CPE Deprecation Remap | [email protected] |
| Jul 22, 2019 | Initial Analysis | [email protected] |