CVE-2022-24469
Published: 09 March 2022
Summary
CVE-2022-24469 is a high-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-24469 is an elevation of privilege vulnerability affecting Azure Site Recovery. The flaw carries a CVSS 3.1 score of 8.1 with a network attack vector, low complexity, and low privileges required, allowing an authenticated remote attacker to obtain high confidentiality and integrity impact without user interaction.
An attacker with low-privileged access to the affected Azure Site Recovery component can exploit the weakness over the network to elevate privileges and access or modify sensitive data within the recovery environment. The unchanged scope rating indicates the impact remains confined to the vulnerable component rather than extending to other Azure resources.
Microsoft's security advisory at msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24469 details available patches and mitigation steps for the issue. The associated EPSS score has remained flat at 0.0721 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29350
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.