CVE-2022-35787
Published: 09 August 2022
Summary
CVE-2022-35787 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery Vmware To Azure. Its CVSS base score is 4.9 (Medium).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35787 is an elevation-of-privilege vulnerability affecting Azure Site Recovery. The flaw carries a CVSS 3.1 base score of 4.9 and permits an authenticated attacker to obtain unauthorized access to sensitive information within the affected service.
An attacker who already possesses high-privileged credentials can exploit the issue over the network without user interaction. Successful exploitation yields high confidentiality impact while leaving integrity and availability unaffected.
Microsoft’s security update guide entries for the CVE describe the availability of patches and recommend that administrators apply the latest updates to Azure Site Recovery components. The associated EPSS score reached a peak of 0.1005 after disclosure before receding to its current value of 0.0807.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38660
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.