{"uuid": "4c6ce5d9-a9e0-4f5a-ba12-9a9c95197b88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28299", "type": "seen", "source": "https://t.me/hacking_Attack/105701", "content": "unknowingly installs the malicious extension.\n4. Once the crafted payload within the extension takes effect, the attacker gains a foothold in the victim\u2019s machine, establishing an initial access point within the organization.\n5. With this initial access, the threat actor can proceed to move laterally within the compromised organization, potentially stealing intellectual property (IP), confidential data, and causing further business impact.\n\nMicrosoft responded promptly to this exploit, assigning it the CVE-2023-28299 identifier and including a fix in the Patch Tuesday update released on April 11, 2023. Varonis Threat Labs delayed the publication of this article to ensure that a fix was made available.\n\nIt is strongly recommended that all systems susceptible to this vulnerability apply the patch provided by Microsoft and remain vigilant for any suspicious activity.\n\nIn summary, CVE-2023-28299 highlights a critical UI bug in Microsoft Visual Studio, a leading IDE, which enables the spoofing of publisher digital signatures. The ease of exploitation, coupled with the potential consequences, makes this vulnerability a significant concern. Threat actors can exploit this flaw to distribute malicious extensions, posing a serious risk to compromised systems. Microsoft has acknowledged this vulnerability and addressed it through the release of a patch as part of their April 11, 2023, Patch Tuesday update.\nTrending: Anonymous Sudan Launches DDoS Attacks on Microsoft Outlook\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: www.varonis.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Images-for-the-News-posts-27-300x150.png Fortinet Releases Urgent Firmware Updates to Address Critical SSL VPN VulnerabilityJune 12, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Images-for-the-News-posts-26-300x150.png Exposed Win32k Windows Vulnerability, Researchers Share Proof-of-Concept ExploitJune 9, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Images-for-the-News-posts-25-300x150.png Honda\u2019s E-commerce Platform Exposed, Researcher Exploits API Flaws for Unrestricted Data AccessJune 8, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Images-for-the-News-posts-24-300x150.png Anonymous Sudan Launches DDoS Attacks on Microsoft OutlookJune 7, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.\nThe post Microsoft Visual Studio Flaw Enables Impersonation of Trusted Publishers first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-04T13:00:03.921811Z"}