CVE-2022-3321
Last modified
CVE-2022-3321 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | Warp Mobile Client | < 6.14 |
References
- https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78Third Party Advisory
- https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3321?
How severe is CVE-2022-3321?
How do I fix CVE-2022-3321?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-33204Four OS command injection vulnerabilities exists in the web …9.9
- CVE-2022-33205Four OS command injection vulnerabilities exists in the web …9.9
- CVE-2022-33206Four OS command injection vulnerabilities exists in the web …9.9
- CVE-2022-33207Four OS command injection vulnerabilities exists in the web …9.9
- CVE-2022-33208Authentication bypass by capture-replay vulnerability exists…8.1
- CVE-2022-33209Improper input validation in the firmware for some Intel(R) …7.8
- CVE-2022-33210Memory corruption in automotive multimedia due to use of out…7.8
- CVE-2022-33211memory corruption in modem due to improper check while calcu…9.8
- CVE-2022-33213Memory corruption in modem due to buffer overflow while proc…8.8
- CVE-2022-33214Memory corruption in display due to time-of-check time-of-us…7
- CVE-2022-33216Transient Denial-of-service in Automotive due to improper in…5.5
- CVE-2022-33217Memory corruption in Qualcomm IPC due to buffer copy without…7.8
Are you affected by CVE-2022-3321?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST