CVE-2022-33669
Published: 12 July 2022
Summary
CVE-2022-33669 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery Vmware To Azure. Its CVSS base score is 4.9 (Medium).
Operationally, ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-33669 is an elevation of privilege vulnerability affecting Azure Site Recovery. It carries a CVSS 3.1 base score of 4.9 with a vector indicating network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality.
An authenticated attacker with high privileges can exploit the flaw over the network to obtain unauthorized access to confidential information within the affected Azure Site Recovery environment. The vulnerability does not allow integrity or availability impacts under the published scoring.
Microsoft has published mitigation guidance for this issue through its Security Response Center at the listed references, including details on available updates and configuration changes. The associated EPSS score has remained flat at a peak of 0.0665 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-36712
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.