CVE-2022-35815
Published: 09 August 2022
Summary
CVE-2022-35815 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35815 is an elevation of privilege vulnerability affecting Azure Site Recovery. It carries a CVSS 3.1 base score of 6.5 reflecting network attack vector, low complexity, required high privileges, no user interaction, and high impact on integrity and availability with no confidentiality impact.
An attacker with high privileges can exploit the flaw remotely to modify or disrupt the affected Azure Site Recovery components, achieving integrity and availability consequences without needing additional user interaction.
The Microsoft Security Response Center advisory at the listed reference URL addresses the issue and should be consulted for official mitigation guidance. The associated EPSS score shows a flat trajectory with both current and peak values at 0.0631.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38688
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.