CVE-2022-2145CWE-20CWE-59

Cloudlfare WARP Arbitrary File Overwrite

Medium · published June 28, 2022

CVSS v3.1
5.8
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.7th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2022-06-28T17:45Z
EPSS history
Timeline
  • 28 JUN 17:45Z
    Cloudlfare WARP Arbitrary File Overwrite
    cvelistv5