CVE-2022-3322
Last modified
CVE-2022-3322 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action. . EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | Warp Mobile Client | < 6.14 |
References
- https://github.com/cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcjThird Party Advisory
- https://github.com/cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcjThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3322?
How severe is CVE-2022-3322?
How do I fix CVE-2022-3322?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-33213Memory corruption in modem due to buffer overflow while proc…8.8
- CVE-2022-33214Memory corruption in display due to time-of-check time-of-us…7
- CVE-2022-33216Transient Denial-of-service in Automotive due to improper in…5.5
- CVE-2022-33217Memory corruption in Qualcomm IPC due to buffer copy without…7.8
- CVE-2022-33218Memory corruption in Automotive due to improper input valida…7.8
- CVE-2022-33219Memory corruption in Automotive due to integer overflow to b…7.8
- CVE-2022-33220Information disclosure in Automotive multimedia due to buffe…5.5
- CVE-2022-33221Information disclosure in Trusted Execution Environment due …5.5
- CVE-2022-33222Information disclosure due to buffer over-read while parsing…7.5
- CVE-2022-33223Transient DOS in Modem due to null pointer dereference while…7.5
- CVE-2022-33224Memory corruption in core due to buffer copy without check9i…7.8
- CVE-2022-33225Memory corruption due to use after free in trusted applicati…7.8
Are you affected by CVE-2022-3322?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST