The Microsoft Azure Site Recovery installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-35772,     CVE-2022-35824)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2022-35774, CVE-2022-35775, CVE-2022-35780,     CVE-2022-35781, CVE-2022-35782, CVE-2022-35783,     CVE-2022-35784, CVE-2022-35785, CVE-2022-35786,     CVE-2022-35787, CVE-2022-35788, CVE-2022-35789,     CVE-2022-35790, CVE-2022-35791, CVE-2022-35799,     CVE-2022-35800, CVE-2022-35801, CVE-2022-35802,     CVE-2022-35807, CVE-2022-35808, CVE-2022-35809,     CVE-2022-35810, CVE-2022-35811, CVE-2022-35812,     CVE-2022-35813, CVE-2022-35814, CVE-2022-35815,     CVE-2022-35816, CVE-2022-35817, CVE-2022-35818,     CVE-2022-35819)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2022-35776)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Security Updates for Microsoft Azure Site Recovery (August 2022)

high Nessus Plugin ID 164502

Version 1.5

Version 1.4

Version 1.5 Mar 23, 2023, 8:46 PM Plugin requirements Plugin Feed: 202303232046
Version 1.4 Mar 23, 2023, 4:25 PM CVSS metrics ("CVSSv2 score" changed from "10.0" to "8.5". "CVSSv2 score" changed from "10.0" to "8.5". "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C" to "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N". "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C" to "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N". "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C" to "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N") CVSSv2 score source (changed from "CVE-2022-35772" to "CVE-2022-35802") Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202303231625