CVE-2022-35784
Published: 09 August 2022
Summary
CVE-2022-35784 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery Vmware To Azure. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35784 is an elevation of privilege vulnerability affecting Azure Site Recovery. It carries a CVSS 3.1 base score of 6.5 reflecting network attack vector, low complexity, required high privileges, and high impact to integrity and availability with no effect on confidentiality.
An authenticated attacker possessing high privileges can exploit the flaw over the network without user interaction to elevate privileges and modify or disrupt the affected recovery service.
Microsoft's security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35784 provides the official advisory and patch information for remediation. The associated EPSS score has remained flat at a peak and current value of 0.0631.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38657
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.