PT-2022-14957

Name of the Vulnerable Software and Affected Versions Cloudflare WARP client for Windows versions up to 2022.5.309.0 Description The issue allows creation of mount points from the ProgramData folder of the Cloudflare WARP client during its installation. This could lead to privilege escalation and...

Cloudflare WARP 后置链接漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare Inc. in the United States. A backlink vulnerability exists in Cloudflare WARP client for Windows versions prior to 2022.5.309.0, which stems from a vulnerability that allows the creation of a mount point...

CVE-2022-2147

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

CVE-2022-2147

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

CVE-2022-2147

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

Design/Logic Flaw

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

CVE-2022-2147 Unquoted Service Path in Cloudflare WARP for Windows

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

CVE-2022-2147

CVE-2022-2147 affects Cloudflare Warp for Windows (versions 2022.2.95.0 and earlier); it is caused by an unquoted service path, enabling arbitrary code execution with privilege escalation via a local attack. The fix is in version 2022.3.186.0. Exploitation status is not provided in the documents....

CVE-2022-2147: Unquoted Search Path or Element

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

PT-2022-14963

Name of the Vulnerable Software and Affected Versions Cloudflare Warp for Windows versions 2022.2.95.0 through 2022.3.185.0 Description The issue is related to an unquoted service path in Cloudflare Warp for Windows, which enables arbitrary code execution leading to privilege escalation...

Cloudflare Warp 代码问题漏洞

Cloudflare Warp Cloudflare Vpn is a client application for secure connections from the American company Cloudflare. A security vulnerability exists in Cloudflare Warp for Windows version 2022.2.95.0. An attacker could exploit the vulnerability to execute arbitrary code leading to elevation of...

Cloudflare Public Bug Bounty: I found another way to bypass Cloudflare Warp lock!

It was possible to bypass Lock WARP switch feature on WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused WARP client to disconnect and allowed the user to bypass...

Cloudflare Public Bug Bounty: Bypass Cloudflare WARP lock on iOS.

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by the client, this feature could be bypassed by using the "Disable WARP" quick action. The issue affected WARP client...

Cloudflare WARP 1.4 - Unquoted Service Path Vulnerability

Exploit Title: Cloudflare WARP 1.4 - Unquoted Service Path Exploit Author: Hejap Zairy Vendor Homepage: https://www.cloudflare.com/ Software Link: https://developers.cloudflare.com/warp-client/get-started/windows/ Version: 1.4.107 Tested: Windows 10 Pro x64 es C:\Users\Hejapsc qc CloudflareWARP S...

Cloudflare WARP 1.4 Unquoted Service Path

Exploit Title: Cloudflare WARP 1.4 - Unquoted Service Path Date: 05/03/2022 Exploit Author: Hejap Zairy Vendor Homepage: https://www.cloudflare.com/ Software Link: https://developers.cloudflare.com/warp-client/get-started/windows/ Version: 1.4.107 Tested: Windows 10 Pro x64 es C:\Users\Hejapsc qc...

Cloudflare WARP 1.4 - Unquoted Service Path

Exploit Title: Cloudflare WARP 1.4 - Unquoted Service Path Date: 05/03/2022 Exploit Author: Hejap Zairy Vendor Homepage: https://www.cloudflare.com/ Software Link: https://developers.cloudflare.com/warp-client/get-started/windows/ Version: 1.4.107 Tested: Windows 10 Pro x64 es C:\Users\Hejapsc qc...

RUSTSEC-2022-0082 Improper validation of Windows paths could lead to directory traversal attack

Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. Th...

acme-dns-rust (>=1.0.0, <=1.0.6), acme2-slim (0.2.0) +163 more potentially affected by unknown CVE via warp (>=0.1.23, <=0.3.1)

warp CARGO version =0.1.23, =1.0.0, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =1.0.0, =0.14.0, =0.4.0, =0.1.0, =0.1.0, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0082...

Improper validation of Windows paths could lead to directory traversal attack

Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. Th...

VulnCheck KEV: CVE-2021-27860

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem...