PT-2022-14957 · Cloudflare · Cloudflare Warp Client

Mskowroncf + 1 · Published 2022-06-28 · Updated 2022-07-08 · CVE-2022-2145

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloudflare WARP client for Windows versions up to 2022.5.309.0

Description The issue allows creation of mount points from the ProgramData folder of the Cloudflare WARP client during its installation. This could lead to privilege escalation and the overwrite of SYSTEM protected files.

Recommendations For versions up to 2022.5.309.0, consider restricting access to the ProgramData folder as a temporary mitigation measure until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

RCE

Weakness Enumeration

CWE-59

CWE-20

Related Identifiers

CVE-2022-2145

GHSA-6FPC-QXMR-6WRQ

Affected Products

Cloudflare Warp Client

References · 4

• https://osv.dev/vulnerability/CVE-2022-2145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2145 · Security Note
• https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq · Note
• https://t.me/cibsecurity/45323 · Telegram Post