CVE-2022-2145

Cloudlfare WARP Arbitrary File Overwrite

State: Published
Severity: 5.8 Medium
Published: Jun 28, 2022
Updated: Aug 3, 2024
Reserved: Jun 21, 2022

Description

Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H	cloudflare

Weaknesses

CWE-20 Improper Input Validation
CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

Product	Versions
WARPCloudflare	before 2022.5.309.0Affected

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.