CVE-2022-33658

Deeper analysis

CVE-2022-33658 is an elevation of privilege vulnerability affecting Azure Site Recovery. The flaw carries a CVSS 3.1 base score of 4.9 and is characterized by network attack vector, low attack complexity, and a requirement for high privileges, resulting in high impact to confidentiality while leaving integrity and availability unaffected.

An authenticated attacker with administrative access to the affected Azure Site Recovery instance can exploit the issue over the network to obtain sensitive information that would otherwise be restricted. Because the vulnerability requires prior high-privilege credentials, it is typically reachable by insiders or compromised administrator accounts rather than unauthenticated external parties.

Microsoft’s Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33658 provides official guidance on available updates and configuration changes that address the weakness. The associated EPSS score has remained flat at 0.1957 with no material increase after disclosure.