CVE-2022-3322 - Lock WARP switch bypass on WARP mobile client using iOS quick action

Back Back to CVE browser

HIGH

Lock WARP switch bypass on WARP mobile client using iOS quick action

Published Oct 28, 2022

7.5

HIGH

CVSS 3.1

EPSS 0.27%

Description

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.

Affected products

Vendor Cloudflare Product WARP Default
unaffected
Affected
- ≥ 0, < 6.14

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Cloudflare	WARP	unaffected	Affected ≥ 0, < 6.14

Remediation

Vendor solution

Upgrade to the specified patched version.

Weaknesses (2)

CWE-347

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42712
Advisory
https://github.com/cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcj
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42712		Advisory
https://github.com/cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcj		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner cloudflare

Published Oct 28, 2022

Updated May 5, 2025

Reserved Sep 26, 2022

Link CVE-2022-3322

CISA Vulnrichment

Updated May 5, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-3322

Red Hat

No data

ENISA EUVD

Assigner cloudflare

Published Oct 28, 2022

Updated May 5, 2025

Link EUVD-2022-42712

GitHub

No data