CVE-2022-33652
Published: 12 July 2022
Summary
CVE-2022-33652 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery Vmware To Azure. Its CVSS base score is 4.9 (Medium).
Operationally, ranked in the top 4.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2022-33652 is an elevation of privilege issue in Azure Site Recovery, published in July 2022 with a CVSS 3.1 score of 4.9 reflecting network access, low complexity, high privileges required, and high confidentiality impact.
An authenticated attacker with high privileges can exploit the flaw over the network to disclose sensitive information, as indicated by the unchanged scope and lack of integrity or availability effects in the provided scoring vector.
Microsoft has published official guidance for the issue through its security update guide, directing administrators to the referenced advisory for details on available patches and configuration changes. The associated EPSS score has remained flat at 0.1957 with no material rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-36695
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.