CVE-2022-35801
Published: 09 August 2022
Summary
CVE-2022-35801 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35801 is an elevation of privilege vulnerability affecting Azure Site Recovery. The flaw carries a CVSS 3.1 base score of 6.5 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, indicating that an authenticated attacker with high privileges can alter or disrupt recovery operations over the network without user interaction.
An attacker who already possesses high-privileged access to the Azure Site Recovery service can exploit the weakness to gain additional integrity and availability control within the affected tenant, enabling unauthorized changes to replication and failover configurations that could impair disaster-recovery workflows.
Microsoft Security Response Center advisories for CVE-2022-35801 direct administrators to apply the updates listed in the official guidance at the referenced Microsoft Update Guide URL. The associated EPSS score has remained flat at 0.0631 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38674
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.