CVE-2022-35776 Azure Site Recovery Denial of Service Vulnerability
Attackers can cause a denial of service in Azure Site Recovery for VMware to Azure migrations, affecting service availability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-35776?
CVE-2022-35776 is a medium-severity denial of service vulnerability in Microsoft Azure Site Recovery VMWare to Azure, published on 9 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Azure Site Recovery Denial of Service Vulnerability
Weakness: CWE-400
Which versions are affected by CVE-2022-35776?
It affects 1 product.
Products include Microsoft Azure Site Recovery Vmware to Azure.
How do I fix CVE-2022-35776?
No fix has been published for CVE-2022-35776 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-35776 being exploited?
There is no known exploitation of CVE-2022-35776 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Azure Site Recovery VMWare to Azure
- CVE-2022-33674 Azure Site Recovery Elevation of Privilege Vulnerability
- CVE-2022-33675 Azure Site Recovery Elevation of Privilege Vulnerability
- CVE-2022-35772 Azure Site Recovery Remote Code Execution Vulnerability
- CVE-2022-35775 Azure Site Recovery Elevation of Privilege Vulnerability
- CVE-2022-35780 Azure Site Recovery Elevation of Privilege Vulnerability
Sources
Also known as GHSA-grc6-9mfg-jh27.