High severity · published Oct 28, 2022
CVE-2022-3322
Lock WARP switch bypass on WARP mobile client using iOS quick action
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Lock Warp switch is a feature of Zero Trust platform which, when
enabled, prevents users of enrolled devices from disabling WARP client.
Due to insufficient policy verification by WARP iOS client, this
feature could be bypassed by using the "Disable WARP" quick action.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WARP · Cloudflare
before 6.14 · source: vendor
WM
Warp Mobile Client · Cloudflare
before 6.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3322
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3322
Third Party Advisory
https://github.com/cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcj
More from WARP
9.8
CVE-2022-3320
Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
8.8
CVE-2022-3512
Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
8.5
CVE-2022-3337
Lock WARP switch bypass by removing VPN profile on iOS mobile client
8.2
CVE-2022-3321
Lock WARP switch feature bypass on WARP mobile client for iOS
8.0
CVE-2022-4428
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the…