Cyber Resilience

CVE-2023-23395

Open Redirect in Microsoft Sharepoint Server 2013 … 2019

Published
14 March 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 3.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0060 46th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2023-23395 is a low-severity Open Redirect (CWE-601) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 3.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-23395 is a spoofing vulnerability in Microsoft SharePoint Server, assigned CWE-601 for URL redirection to an untrusted site. It carries a CVSS 3.1 base score of 3.1 reflecting network attack vector, high attack complexity, no required privileges, and required user interaction, resulting in limited integrity impact with no confidentiality or availability effects.

An unauthenticated attacker can send a crafted link that, once clicked by a victim, redirects the user to an attacker-controlled destination. This allows the adversary to present spoofed content or capture limited session-related actions while operating within the constraints of the high complexity and user-interaction requirements.

Microsoft has published remediation guidance in its Security Response Center update guide for CVE-2023-23395, directing administrators to apply the available security updates for affected SharePoint Server versions. The associated EPSS score remains low, with a current value of 0.0628 and a peak of 0.0762.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Microsoft SharePoint Server Spoofing Vulnerability

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1566 Phishing Initial Access
Adversaries may send phishing messages to gain access to victim systems.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-21401Same vendor: Microsoft
CVE-2023-21742Same product: Microsoft Sharepoint Foundation
CVE-2024-43536Same vendor: Microsoft
CVE-2024-43543Same vendor: Microsoft
CVE-2023-21744Same product: Microsoft Sharepoint Foundation
CVE-2022-44690Same product: Microsoft Sharepoint Foundation
CVE-2023-28288Same product: Microsoft Sharepoint Foundation
CVE-2026-33102Same vendor: Microsoft
CVE-2026-41106Same vendor: Microsoft
CVE-2026-47645Same vendor: Microsoft

Affected Assets

microsoft
sharepoint foundation
2013
microsoft
sharepoint server
2013, 2019, all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V3.7.2

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-601

Security awareness includes verifying URLs and avoiding untrusted redirects that lead to malicious sites.

addresses: CWE-601

Validates redirect targets and URLs to ensure they conform to allowed destinations.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

mitigates

Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.

References