WA
Product
WARP
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 13Medium 4Low 1
Watch
Add WARP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-3320 | 9.8 | Oct 28 | Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command Affected: before 2022.8.857.0; before 2022.8.936; before 2022.8.861.0 |
| CVE-2022-3512 | 8.8 | Oct 28 | Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command Affected: before 2022.8.857; before 2022.8.936; before 2022.8.861 |
| CVE-2022-3337 | 8.5 | Oct 28 | Lock WARP switch bypass by removing VPN profile on iOS mobile client Affected: before 6.15 |
| CVE-2022-3321 | 8.2 | Oct 28 | Lock WARP switch feature bypass on WARP mobile client for iOS Affected: before 6.14 |
| CVE-2022-4428 | 8.0 | Jan 11 | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the… Affected: through 2022.10.106.0 |
| CVE-2023-0652 | 7.8 | Apr 6 | Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a… Affected: before 2023.3.381.0 |
| CVE-2023-1412 | 7.8 | Apr 5 | An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations… Affected: before 2023.3.381.0 |
| CVE-2022-2225 | 7.8 | Jul 26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g Affected: before 2022.5.227.0; before 2022.5.341.0; before 2022.5.346 |
| CVE-2022-2145 | 7.8 | Jun 28 | Cloudflare WARP client for Windows (up to v Affected: before 2022.5.309.0 |
| CVE-2022-2147 | 7.8 | Jun 23 | Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation Affected: 2022.2.95.0 before 2022.3.186.0 |
| CVE-2020-35152 | 7.8 | Feb 3 | Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path Affected: before 1.2.2695.1 |
| CVE-2022-3322 | 7.5 | Oct 28 | Lock WARP switch bypass on WARP mobile client using iOS quick action Affected: before 6.14 |
| CVE-2023-1862 | 7.3 | Jun 20 | Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an… Affected: through 2023.3.381.0 |
| CVE-2025-0651 | 7.1 | Jan 22 | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation Affected: before 2024.12.492.0 |
| CVE-2023-2754 | 6.8 | Aug 3 | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner,… Affected: before 2023.7.160.0 |
| CVE-2023-3747 | 5.5 | Sep 7 | Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices Affected: 6.29 |
| CVE-2023-0238 | 5.5 | Aug 29 | Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on a victim's device to… Affected: before 6.29 |
| CVE-2022-4457 | 5.5 | Jan 11 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack Affected: before 6.20 |
| CVE-2023-0654 | 3.7 | Aug 29 | Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack Affected: before 6.29 |
Showing 19