Lucene search

PRIOn knowledge basePRION:CVE-2022-3337

HistoryOct 28, 2022 - 10:15 a.m.

Information disclosure

2022-10-2810:15:00

PRIOn knowledge base

www.prio-n.com

user deletion

vpn profile

warp mobile

ios platform

lock warp switch

zero trust platform

policy bypass

enrolled devices

nvd

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.4%

It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature
being enabled on Zero Trust Platform. This led to bypassing policies
and restrictions enforced for enrolled devices by the Zero Trust
platform.

CPENameOperatorVersion
warp_mobile_clientlt6.15

CPE	Name	Operator	Version
	warp_mobile_client	lt	6.15

References

github.com/cloudflare/advisories/security/advisories/GHSA-vr93-4vx7-332p