CVE-2022-33668
Published: 12 July 2022
Summary
CVE-2022-33668 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery Vmware To Azure. Its CVSS base score is 4.9 (Medium).
Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Azure Site Recovery contains an elevation of privilege vulnerability tracked as CVE-2022-33668 and published on 12 July 2022. The flaw is rated 4.9 under CVSS 3.1 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating that a network-accessible attack can disclose high-value information when carried out by an already-privileged account.
An authenticated attacker possessing high privileges can leverage the weakness to read confidential data that would otherwise be inaccessible, while integrity and availability remain unaffected. No user interaction is required and the scope of the compromise stays unchanged.
Microsoft has published an advisory for the issue at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33668. The associated EPSS score has remained flat at a peak and current value of 0.0644, indicating no material rise in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-36711
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.