Lucene search
HistoryOct 28, 2022 - 10:15 a.m.
CVE-2022-3512
cve-2022-3512
warp client
trusted ssid
bypass vulnerability
zero trust policies
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
42.8%
Using warp-cli command “add-trusted-ssid”, a user was able to disconnect WARP client and bypass the “Lock WARP switch” feature resulting in Zero Trust policies not being enforced on an affected endpoint.
Affected configurations
Node
cloudflarewarpRange<2022.8.857.0windows
ORcloudflarewarpRange<2022.8.861.0macos
ORcloudflarewarpRange<2022.8.936linux_kernel
Related
cvelist
cvelist
prion
prion
Design/Logic Flaw
2022-10-28 10:15:00
alpinelinux
alpinelinux
CVE-2022-3512
2022-10-28 10:15:17
cve
cve
CVE-2022-3512
2022-10-28 10:15:17
hackerone
hackerone
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
42.8%
Related for NVD:CVE-2022-3512