The Microsoft Azure Site Recovery installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-35772,     CVE-2022-35824)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2022-35774, CVE-2022-35775, CVE-2022-35780,     CVE-2022-35781, CVE-2022-35782, CVE-2022-35783,     CVE-2022-35784, CVE-2022-35785, CVE-2022-35786,     CVE-2022-35787, CVE-2022-35788, CVE-2022-35789,     CVE-2022-35790, CVE-2022-35791, CVE-2022-35799,     CVE-2022-35800, CVE-2022-35801, CVE-2022-35802,     CVE-2022-35807, CVE-2022-35808, CVE-2022-35809,     CVE-2022-35810, CVE-2022-35811, CVE-2022-35812,     CVE-2022-35813, CVE-2022-35814, CVE-2022-35815,     CVE-2022-35816, CVE-2022-35817, CVE-2022-35818,     CVE-2022-35819)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2022-35776)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Security Updates for Microsoft Azure Site Recovery (August 2022)

high Nessus Plugin ID 164502

Version 1.4