CVE-2022-3322

Lock WARP switch bypass on WARP mobile client using iOS quick action

State: Published
Severity: 6.7 Medium
Published: Oct 28, 2022
Updated: May 5, 2025
Reserved: Sep 26, 2022

Description

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L	cloudflare

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
WARPCloudflare	before 6.14Affected

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcj

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.