What is the CVSS score of CVE-2019-1084?

CVE-2019-1084 has a CVSS 3.0 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 5.3%.

Is there a patch available for CVE-2019-1084?

Yes, a patch is available for CVE-2019-1084. Update the affected software to the latest version immediately.

Exchange Server CVE-2019-1084

MEDIUM

Information Exposure (CWE-200)

2019-07-15 secure@microsoft.com

Microsoft Information Disclosure Exchange Server Lync Lync Basic Mail And Calendar Office Office 365 Proplus Outlook Skype For Business Skype For Business Basic

6.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jul 15, 2019 - 19:15 nvd

MEDIUM 6.5

DescriptionNVD

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

AnalysisAI

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'. Affected products include: Microsoft Exchange Server, Microsoft Lync, Microsoft Lync Basic, Microsoft Mail And Calendar, Microsoft Office.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.