CVE-2023-28288
Published: 11 April 2023
Summary
CVE-2023-28288 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Microsoft SharePoint Server is affected by CVE-2023-28288, a spoofing vulnerability assigned a CVSS 3.1 base score of 8.1. The flaw is also tagged under CWE-918 and was publicly disclosed on 11 April 2023.
An authenticated attacker with low privileges can exploit the issue over the network with low attack complexity and no user interaction. Successful exploitation allows the attacker to achieve high impact on confidentiality and integrity while leaving availability unaffected.
The primary advisory published by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28288 details available patches and mitigation steps for supported SharePoint Server versions.
The associated EPSS score rose from a lower baseline to a peak of 0.1401 on 22 January 2025 before receding to its current value of 0.0909, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31995
Vulnerability details
Microsoft SharePoint Server Spoofing Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.