WARP

9 results · Clear filters · Feed

• Medium 6.1
  CVE-2025-0651 Public exploit

  File symlink abuse might lead to deleting files belonging to SYSTEM user

  Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges  can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all…

  Cloudflare WARP
  Jan 22, 2025
• Medium 5.5
  CVE-2022-4457

  WARP client manifest misconfiguration leading to Task Hijacking

  Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive info…

  Cloudflare WARP
  Jan 11, 2023
• Medium 6.7
  CVE-2022-3320

  Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command

  It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restr…

  Cloudflare WARP
  Oct 28, 2022
• Medium 6.7
  CVE-2022-3322

  Lock WARP switch bypass on WARP mobile client using iOS quick action

  Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" qui…

  Cloudflare WARP
  Oct 28, 2022
• Medium 6.7
  CVE-2022-3337

  Lock WARP switch bypass by removing VPN profile on iOS mobile client

  It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch  feature being enabled on…

  Cloudflare WARP
  Oct 28, 2022
• Medium 6.7
  CVE-2022-3321

  Lock WARP switch feature bypass on WARP mobile client for iOS

  It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch  on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable f…

  Cloudflare WARP
  Oct 28, 2022
• Medium 6.7
  CVE-2022-3512

  Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command

  Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint.

  Cloudflare WARP
  Oct 28, 2022
• Medium 5.8
  CVE-2022-2145

  Cloudlfare WARP Arbitrary File Overwrite

  Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.

  Cloudflare WARP
  Jun 28, 2022
• Medium 6.5
  CVE-2022-2147

  Unquoted Service Path in Cloudflare WARP for Windows

  Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0.

  Cloudflare WARP
  Jun 23, 2022