Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:NSummary
CVE-2023-23395 is a low-severity Open Redirect (CWE-601) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 3.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-23395 is a spoofing vulnerability in Microsoft SharePoint Server, assigned CWE-601 for URL redirection to an untrusted site. It carries a CVSS 3.1 base score of 3.1 reflecting network attack vector, high attack complexity, no required privileges, and required user interaction, resulting in limited integrity impact with no confidentiality or availability effects.
An unauthenticated attacker can send a crafted link that, once clicked by a victim, redirects the user to an attacker-controlled destination. This allows the adversary to present spoofed content or capture limited session-related actions while operating within the constraints of the high complexity and user-interaction requirements.
Microsoft has published remediation guidance in its Security Response Center update guide for CVE-2023-23395, directing administrators to apply the available security updates for affected SharePoint Server versions. The associated EPSS score remains low, with a current value of 0.0628 and a peak of 0.0762.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-27495
Vulnerability Data
Microsoft SharePoint Server Spoofing Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.7.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.