PT-2023-16430 · Unknown · Warp Mobile Client

Ncabetecf · Publicado 2023-08-29 · Atualizado 2023-09-01 · CVE-2023-0654

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WARP Mobile Client versions prior to 6.29

Description The issue is due to a misconfiguration, making the WARP Mobile Client susceptible to a tapjacking attack. If an attacker installs a malicious application on a victim's device, they can trick the user into believing the app shown on the screen is the WARP client when, in reality, it is the attacker's app.

Recommendations For versions prior to 6.29, update to version 6.29 or later to resolve the issue. As a temporary workaround, consider restricting the installation of applications from unknown sources to minimize the risk of exploitation.

Correção

Clickjacking

Enumeração de Fraquezas

CWE-1021

Identificadores relacionados

CVE-2023-0654

GHSA-5R97-PQV6-XPX7

Produtos afetados

Warp Mobile Client

Referências · 7

• https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7 · Nota
• https://twitter.com/CVEnew/status/1696542188170068250 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1696592736286105601 · Publicação no Twitter
• https://t.me/cibsecurity/69369 · Publicação no Telegram
• https://developers.cloudflare.com/warp-client · Nota
• https://osv.dev/vulnerability/CVE-2023-0654 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0654 · Nota de Segurança