Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12582
HistoryJul 12, 2022 - 12:00 a.m.

KLA12582 Multiple vulnerabilities in Microsoft Azure

2022-07-1200:00:00
Kaspersky Lab
threats.kaspersky.com
15

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.3 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

8.4 High

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.2%

JSON

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information.

Below is a complete list of vulnerabilities:

  1. A remote code execution vulnerability in Azure Site Recovery can be exploited remotely to execute arbitrary code.
  2. An elevation of privilege vulnerability in Azure Site Recovery can be exploited remotely to gain privileges.
  3. An information disclosure vulnerability in Azure Storage Library can be exploited remotely to obtain sensitive information.

Original advisories

CVE-2022-33676

CVE-2022-33666

CVE-2022-33660

CVE-2022-33672

CVE-2022-33643

CVE-2022-33667

CVE-2022-33664

CVE-2022-33661

CVE-2022-33658

CVE-2022-33657

CVE-2022-33659

CVE-2022-33673

CVE-2022-30187

CVE-2022-33653

CVE-2022-33669

CVE-2022-33650

CVE-2022-33674

CVE-2022-33665

CVE-2022-33656

CVE-2022-33641

CVE-2022-33642

CVE-2022-33662

CVE-2022-33675

CVE-2022-30181

CVE-2022-33663

CVE-2022-33655

CVE-2022-33671

CVE-2022-33678

CVE-2022-33668

CVE-2022-33654

CVE-2022-33652

CVE-2022-33651

CVE-2022-33677

Related products

Microsoft-Azure

CVE list

CVE-2022-33676 high

CVE-2022-33666 high

CVE-2022-33660 warning

CVE-2022-33672 high

CVE-2022-33643 high

CVE-2022-33667 high

CVE-2022-33664 warning

CVE-2022-33661 high

CVE-2022-33658 warning

CVE-2022-33657 high

CVE-2022-33659 warning

CVE-2022-33673 high

CVE-2022-30187 warning

CVE-2022-33653 warning

CVE-2022-33669 warning

CVE-2022-33650 warning

CVE-2022-33674 critical

CVE-2022-33665 high

CVE-2022-33656 high

CVE-2022-33641 high

CVE-2022-33642 warning

CVE-2022-33662 high

CVE-2022-33675 critical

CVE-2022-30181 high

CVE-2022-33663 high

CVE-2022-33655 high

CVE-2022-33671 warning

CVE-2022-33678 high

CVE-2022-33668 warning

CVE-2022-33654 warning

CVE-2022-33652 warning

CVE-2022-33651 warning

CVE-2022-33677 high

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

  • ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

  • OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

  • PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

  • Azure Storage Queues client library for PythonAzure Storage Blobs client library for JavaAzure Site Recovery VMWare to AzureAzure Storage Queues client library for .NETAzure Storage Blobs client library for .NET

References

Related

nessus 2
mscve 30
rapid7blog 1
cvelist 30
prion 30
nvd 30
cnvd 30
cve 30
vulnrichment 9
kaspersky 1
msrc 3
gitlab 2
ubuntucve 1
nessus
nessus
Security Updates for Microsoft Azure Site Recovery (July 2022)
2022-08-30 00:00:00
SUSE SLES15 Security Update : python-azure-storage-queue (SUSE-SU-2023:4609-1)
2023-11-29 00:00:00
mscve
mscve
Azure Site Recovery Remote Code Execution Vulnerability
2022-07-12 07:00:00
Azure Site Recovery Elevation of Privilege Vulnerability
2022-07-12 07:00:00
Azure Site Recovery Elevation of Privilege Vulnerability
2022-07-12 07:00:00
rapid7blog
rapid7blog
Patch Tuesday - July 2022
2022-07-12 19:40:15
cvelist
cvelist
CVE-2022-33662 Azure Site Recovery Elevation of Privilege Vulnerability
2022-07-12 22:38:23
CVE-2022-33674 Azure Site Recovery Elevation of Privilege Vulnerability
2022-07-12 22:38:39
CVE-2022-33660 Azure Site Recovery Elevation of Privilege Vulnerability
2022-07-12 22:38:20
prion
prion
Privilege escalation
2022-07-12 23:15:00
Privilege escalation
2022-07-12 23:15:00
Privilege escalation
2022-07-12 23:15:00
nvd
nvd
CVE-2022-33677
2022-07-12 23:15:13
CVE-2022-33674
2022-07-12 23:15:13
CVE-2022-33654
2022-07-12 23:15:12
cnvd
cnvd
Microsoft Azure Site Recovery Elevation of Privilege Vulnerability (CNVD-2022-56596)
2022-07-13 00:00:00
Microsoft Azure Site Recovery Elevation of Privilege Vulnerability (CNVD-2022-57196)
2022-07-13 00:00:00
Microsoft Azure Site Recovery Elevation of Privilege Vulnerability (CNVD-2022-56595)
2022-07-13 00:00:00
cve
cve
CVE-2022-33673
2022-07-12 23:15:13
CVE-2022-33662
2022-07-12 23:15:13
CVE-2022-33674
2022-07-12 23:15:13
vulnrichment
vulnrichment
CVE-2022-33675 Azure Site Recovery Elevation of Privilege Vulnerability
2022-07-12 22:38:41
CVE-2022-33653 Azure Site Recovery Elevation of Privilege Vulnerability
2022-07-12 22:38:10
CVE-2022-33665 Azure Site Recovery Elevation of Privilege Vulnerability
2022-07-12 22:38:28
kaspersky
kaspersky
KLA12585 OSI vulnerability in Microsoft Dynamics
2022-07-12 00:00:00
msrc
msrc
Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability
2022-07-18 07:00:00
Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability
2022-07-18 13:40:00
Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability
2022-07-18 07:00:00
gitlab
gitlab
Exposure of Resource to Wrong Sphere
2022-07-13 00:00:00
Exposure of Resource to Wrong Sphere
2022-07-13 00:00:00
ubuntucve
ubuntucve
CVE-2022-30187
2022-07-12 00:00:00

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.3 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

8.4 High

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.2%

JSON
Related for KLA12582
nessus2mscve30rapid7blog1cvelist30prion30nvd30cnvd30cve30vulnrichment9kaspersky1msrc3gitlab2ubuntucve1