Cyber Resilience

CVE-2023-28288

HighPublic PoC

Published: 11 April 2023

Published
11 April 2023
Modified
01 January 2025
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0909 92.8th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-28288 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Microsoft SharePoint Server is affected by CVE-2023-28288, a spoofing vulnerability assigned a CVSS 3.1 base score of 8.1. The flaw is also tagged under CWE-918 and was publicly disclosed on 11 April 2023.

An authenticated attacker with low privileges can exploit the issue over the network with low attack complexity and no user interaction. Successful exploitation allows the attacker to achieve high impact on confidentiality and integrity while leaving availability unaffected.

The primary advisory published by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28288 details available patches and mitigation steps for supported SharePoint Server versions.

The associated EPSS score rose from a lower baseline to a peak of 0.1401 on 22 January 2025 before receding to its current value of 0.0909, indicating a period of increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

Microsoft SharePoint Server Spoofing Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
sharepoint foundation
2013
microsoft
sharepoint server
2013, 2016, 2019, all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

References