CVE-2022-3322
Assigner: cloudflare
Published: 2022-10-28T09:25:55.997Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: iOS
product: WARP
vendor: Cloudflare
versions: lessThan: 6.14
status: affected
version: 0
versionType: semver
configurations: supportingMedia: base64: no
type: text/html
value: Endpoint enrolled on Cloudflare Zero Trust (Cloudflare One)<br>
value: Endpoint enrolled on Cloudflare Zero Trust (Cloudflare One)

credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Josh (joshmotionfans)
descriptions: supportingMedia: base64: no
type: text/html
value: <div><p>Lock Warp switch is a feature of Zero Trust platform which, when
 enabled, prevents users of enrolled devices from disabling WARP client.
 Due to insufficient policy verification by WARP iOS client, this 
feature could be bypassed by using the "Disable WARP" quick action.</p></div>
value: Lock Warp switch is a feature of Zero Trust platform which, when
 enabled, prevents users of enrolled devices from disabling WARP client.
 Due to insufficient policy verification by WARP iOS client, this 
feature could be bypassed by using the "Disable WARP" quick action.




impacts: capecId: CAPEC-122
descriptions: value: CAPEC-122 Privilege Abuse
capecId: CAPEC-554
descriptions: value: CAPEC-554 Functionality Bypass
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Upgrade to the specified patched version.<br>
value: Upgrade to the specified patched version.

source: advisory: GHSA-76pg-rp9h-wmcj
discovery: EXTERNAL
title: Lock WARP switch bypass on WARP mobile client using iOS quick action
x_generator: engine: Vulnogram 0.1.0-dev