CVE-2020-35152 — MEDIUM (4.5)

Q: How severe is CVE-2020-35152?

CVE-2020-35152 has been rated MEDIUM with a CVSS base score of 4.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2020-35152?

Check the references section above for vendor advisories and patch information. Affected products include: Cloudflare Warp.

Vulnerability Description

Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. Since version 1.2.2695.1, the vulnerability was fixed by adding quotes around the service's binary path. This issue affects Cloudflare WARP for Windows, versions prior to 1.2.2695.1.

CVSS Score

4.5

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Cloudflare	Warp	< 1.2.2695.1

Related Weaknesses (CWE)

CWE-428

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-qc57-v5q8-f22hThird Party Advisory
https://github.com/cloudflare/advisories/security/advisories/GHSA-qc57-v5q8-f22hThird Party Advisory

FAQ

What is CVE-2020-35152?

CVE-2020-35152 is a vulnerability with a CVSS score of 4.5 (MEDIUM). Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing t...

How severe is CVE-2020-35152?

CVE-2020-35152 has been rated MEDIUM with a CVSS base score of 4.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-35152?

Check the references section above for vendor advisories and patch information. Affected products include: Cloudflare Warp.