CVE-2022-2145

Published: Jun 28, 2022Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.

Affected (1)

Products: Cloudflare: Warp

Cloudflare

1 product

Warp

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cloudflare Warp	Before 2022.5.309.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (2)

https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq

Source: cna@cloudflare.com

Release NotesThird Party Advisory

https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

Timeline

No history available yet.