PT-2021-11718 · Cloudflare · Cloudflare Warp

James Tan + 1 · Published 2021-02-02 · Updated 2021-02-05 · CVE-2020-35152

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cloudflare WARP for Windows versions prior to 1.2.2695.1

Description: The issue allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. The vulnerability was fixed by adding quotes around the service's binary path.

Recommendations: For versions prior to 1.2.2695.1, update to version 1.2.2695.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the service until a patch is applied.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2020-35152

GHSA-QC57-V5Q8-F22H

Affected Products

Cloudflare Warp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-35152 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35152 · Vendor Advisory
• https://github.com/cloudflare/advisories/security/advisories/GHSA-qc57-v5q8-f22h · Note
• https://t.me/cibsecurity/22992 · Telegram Post
• https://t.me/cvenotify/9284 · Telegram Post