CVE-2022-2225

Zero Trust Secure Web Gateway policies bypass using WARP client subcommands

State: Published
Severity: 8.1 High
Published: Jul 26, 2022
Updated: Aug 3, 2024
Reserved: Jun 27, 2022

Description

By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H	cloudflare

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
WARPCloudflare	before 2022.5.341.0Affected
WARPCloudflare	before 2022.5.346Affected
WARPCloudflare	before 2022.5.227.0Affected

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-cg88-vx48-976c

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.