Vulnerabilities > CVE-2022-3337 - Missing Authorization vulnerability in Cloudflare Warp Mobile Client

CVSS 8.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

LOW

network

low complexity

cloudflare

CWE-862

NVD

Published: 2022-10-28

Updated: 2023-11-07

Summary

It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.

Vulnerable Configurations

Part	Description	Count
Application	Cloudflare Cloudflare Warp Mobile Client 4.4 Cloudflare Warp Mobile Client 4.5 Cloudflare Warp Mobile Client 5.0 Cloudflare Warp Mobile Client 5.1 Cloudflare Warp Mobile Client 5.2 Cloudflare Warp Mobile Client 5.3 Cloudflare Warp Mobile Client 5.4 Cloudflare Warp Mobile Client 5.5 Cloudflare Warp Mobile Client 6.0 Cloudflare Warp Mobile Client 6.1 Cloudflare Warp Mobile Client 6.2 Cloudflare Warp Mobile Client 6.3 Cloudflare Warp Mobile Client 6.4 Cloudflare Warp Mobile Client 6.5 Cloudflare Warp Mobile Client 6.6 Cloudflare Warp Mobile Client 6.7 Cloudflare Warp Mobile Client 6.8 Cloudflare Warp Mobile Client 6.9 Cloudflare Warp Mobile Client 6.10 Cloudflare Warp Mobile Client 6.11 Cloudflare Warp Mobile Client 6.12 Cloudflare Warp Mobile Client 6.13 Cloudflare Warp Mobile Client 6.14	23

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-vr93-4vx7-332p