CVE-2022-35817
Published: 09 August 2022
Summary
CVE-2022-35817 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35817 is an elevation-of-privilege vulnerability in Azure Site Recovery. The flaw received a CVSS v3.1 base score of 6.5 and is described by Microsoft as allowing an attacker to elevate privileges within the affected Azure service.
An attacker must already possess high privileges and have network access to the Azure Site Recovery instance. Successful exploitation permits modification of integrity and availability properties without requiring user interaction, while leaving confidentiality unaffected.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35817 supplies the official remediation guidance and patch availability details for Azure Site Recovery customers.
EPSS for the CVE has remained flat at a peak of 0.0631 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38690
Vulnerability details
Azure Site Recovery Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.