Cloudflare WARP iOS Lock Switch Bypass
CVE-2022-3322 Published on October 28, 2022
Lock WARP switch bypass on WARP mobile client using iOS quick action
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.
Vulnerability Analysis
CVE-2022-3322 is exploitable with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and a small impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2022-3322 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2022-3322
stack.watch emails you whenever new vulnerabilities are published in CloudFlare Warp Mobile Client or CloudFlare Warp. Just hit a watch button to start following.
Affected Versions
Cloudflare WARP:- Before 6.14 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.