Vulnerability Details : CVE-2022-3337
It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.
Products affected by CVE-2022-3337
- cpe:2.3:a:cloudflare:warp_mobile_client:*:*:*:*:*:iphone_os:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-3337
0.02%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 3 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-3337
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.7
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L |
1.5
|
4.7
|
Cloudflare, Inc. | |
|
8.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L |
3.1
|
4.7
|
NIST |
CWE ids for CVE-2022-3337
-
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.Assigned by: nvd@nist.gov (Primary)
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by:
- cna@cloudflare.com (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2022-3337
-
https://github.com/cloudflare/advisories/security/advisories/GHSA-vr93-4vx7-332p
Lock WARP switch bypass by removing VPN profile on iOS mobile client · Advisory · cloudflare/advisories · GitHubThird Party Advisory
Jump to