A researcher who notified Microsoft that he'd found a vulnerability has been told by 'a middleman' that its severity is low