Cyber Resilience

CVE-2023-28277

Medium

Published: 11 April 2023

Published
11 April 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0774 92.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-28277 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Microsoft Windows Server 2022. Its CVSS base score is 4.9 (Medium).

Operationally, ranked in the top 7.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2023-28277 is an information disclosure vulnerability affecting the Windows DNS Server component. It carries a CVSS 3.1 base score of 4.9 and is associated with CWE-190, indicating an integer overflow or wraparound condition that can lead to unintended exposure of sensitive data.

An attacker with high privileges can exploit the flaw over the network with low attack complexity and no user interaction required. Successful exploitation allows the attacker to obtain confidential information from the DNS server while leaving integrity and availability unaffected.

Microsoft has published remediation guidance for the issue through its Security Response Center at the referenced update-guide URL. The EPSS score has remained flat at a peak of 0.0774 since disclosure, indicating no material increase in observed exploitation interest.

EU & UK References

Vulnerability details

Windows DNS Server Information Disclosure Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows server 2022
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References