Medium · 6.5 CVE-2022-2147 EUVD-2022-34432GHSA-frq6-c9vg-hmxj

Unquoted Service Path in Cloudflare WARP for Windows

Published Jun 23, 2022 · Updated Aug 3, 2024 · Assigned by cloudflare

Description

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0.

Affected products

Vendor	Product	Affected	Fixed
Cloudflare	WARP	2022.2.95.0 – < unspecified, unspecified – < 2022.3.186.0	unspecified

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-m6w8-3pf9-p68r