CVE-2023-28299
Published: 11 April 2023
Summary
CVE-2023-28299 is a medium-severity an unspecified weakness vulnerability in Microsoft Visual Studio 2022. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 35.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-28299 is a spoofing vulnerability affecting Visual Studio. It carries a CVSS 3.1 base score of 5.5 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating that successful exploitation can produce high integrity impact while requiring only local access and low privileges.
An attacker with local access and low privileges can exploit the flaw without user interaction to spoof content or behavior within the Visual Studio environment, thereby achieving unauthorized integrity changes on the affected system.
Microsoft has published remediation guidance in its Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28299.
The associated EPSS score remained low after the April 2023 disclosure but rose sharply to a peak of 0.3164 on 2025-01-22 before receding, indicating a period of increased exploitation interest well after initial publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32006
Vulnerability details
Visual Studio Spoofing Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.