CVE-2022-35791
Published: 09 August 2022
Summary
CVE-2022-35791 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery Vmware To Azure. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35791 is an elevation of privilege vulnerability affecting Azure Site Recovery. It carries a CVSS 3.1 base score of 6.5 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, indicating that an attacker who already possesses high privileges can achieve high impact on integrity and availability over the network without user interaction.
An authenticated attacker with administrative access can exploit the flaw to elevate privileges and modify or disrupt recovery operations. The attack requires valid high-privilege credentials and does not rely on user interaction or special network positioning beyond normal reachability.
Microsoft publishes mitigation guidance and patch information for this issue in its Security Response Center update guide at the referenced URL. The current and peak EPSS scores are both 0.0631, showing no material post-disclosure rise in exploitation probability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38664
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.