CVE-2023-2754CWE-319

Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client

High · published August 3, 2023

CVSS v3.1
7.4
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses but Unique Local Addresses, which under certain conditions could point towards unknown devices in the same local network which enables an Attacker to view DNS queries made by the device.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00920 · 59.9th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2023-08-03T13:53Z
EPSS history
Timeline
  • 03 AUG 13:53Z
    Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client
    cvelistv5