CVE-2022-2225CWE-284

Zero Trust Secure Web Gateway policies bypass using WARP client subcommands

High · published July 26, 2022

CVSS v3.1
8.1
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2022-07-26T11:35Z
EPSS history
Timeline
  • 26 JUL 11:35Z
    Zero Trust Secure Web Gateway policies bypass using WARP client subcommands
    cvelistv5