CVE-2022-23292

Deeper analysis

Microsoft Power BI contains a spoofing vulnerability tracked as CVE-2022-23292. The flaw received a CVSS 3.1 base score of 3.7, reflecting network attack vector, high attack complexity, low privileges required, and user interaction needed, with limited impact on confidentiality and integrity but none on availability.

An authenticated attacker positioned on the network can leverage the issue to present falsified content or interface elements to a victim user. Successful exploitation allows the attacker to obtain limited information or induce limited unauthorized actions within the Power BI environment, though the high complexity and required user interaction constrain the practicality of such attacks.

Microsoft published guidance for the vulnerability through its Security Response Center at the listed advisory URL. The EPSS score rose from a low baseline to a peak of 0.0553 on 2025-01-22 before receding to the current value of 0.0083, indicating a period of increased exploitation interest well after initial disclosure.