CVE-2022-35808

Deeper analysis

Azure Site Recovery contains an elevation of privilege vulnerability tracked as CVE-2022-35808. The flaw received a CVSS 3.1 score of 6.5 with a vector indicating network attack vector, low attack complexity, and high privileges required, resulting in high impact to integrity and availability but none to confidentiality.

An authenticated attacker who already possesses high privileges on the affected Azure Site Recovery instance can exploit the weakness over the network to elevate those privileges and modify or disrupt recovery operations. The absence of required user interaction lowers the bar for an adversary already inside the management plane.

Microsoft published remediation guidance in its Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35808, directing administrators to apply the listed updates for Azure Site Recovery. The associated EPSS score has remained flat at 0.0631 with no material increase after disclosure.