Lucene search

K
cve[email protected]CVE-2023-0654
HistoryAug 29, 2023 - 4:15 p.m.

CVE-2023-0654

2023-08-2916:15:08
CWE-1021
web.nvd.nist.gov
14
cve-2023-0654
misconfiguration
warp mobile client
android
tapjacking
vulnerability
security bug

3.9 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

4.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim’s device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker’s app.

Affected configurations

NVD
Node
cloudflarewarpRange<6.29android
CPENameOperatorVersion
cloudflare:warpcloudflare warplt6.29

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Android"
    ],
    "product": "WARP Client",
    "vendor": "Cloudflare",
    "versions": [
      {
        "changes": [
          {
            "at": "6.29",
            "status": "unaffected"
          }
        ],
        "lessThan": "6.29",
        "status": "affected",
        "version": "0",
        "versionType": "patch"
      }
    ]
  }
]

3.9 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

4.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

Related for CVE-2023-0654