Vulnerability Description
It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | Warp Mobile Client | < 6.14 |
Related Weaknesses (CWE)
References
- https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78Third Party Advisory
- https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78Third Party Advisory
FAQ
What is CVE-2022-3321?
CVE-2022-3321 is a vulnerability with a CVSS score of 6.7 (MEDIUM). It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by ...
How severe is CVE-2022-3321?
CVE-2022-3321 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3321?
Check the references section above for vendor advisories and patch information. Affected products include: Cloudflare Warp Mobile Client.