CVE-2022-3321CWE-862

Lock WARP switch feature bypass on WARP mobile client for iOS

Medium · published October 28, 2022

CVSS v3.1
6.7
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch  on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-10-28T09:24Z
EPSS history
Timeline
  • 28 OCT 09:24Z
    Lock WARP switch feature bypass on WARP mobile client for iOS
    cvelistv5