PT-2022-14963 · Cloudflare · Cloudflare Warp

Jdgregson + 2 · Published 2022-06-23 · Updated 2022-07-01 · CVE-2022-2147

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloudflare Warp for Windows versions 2022.2.95.0 through 2022.3.185.0

Description The issue is related to an unquoted service path in Cloudflare Warp for Windows, which enables arbitrary code execution leading to privilege escalation.

Recommendations For versions 2022.2.95.0 through 2022.3.185.0, update to version 2022.3.186.0 to resolve the issue.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2022-2147

GHSA-M6W8-3PF9-P68R

Affected Products

Cloudflare Warp

References · 5

• https://osv.dev/vulnerability/CVE-2022-2147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2147 · Security Note
• https://github.com/cloudflare/advisories/security/advisories/GHSA-m6w8-3pf9-p68r · Note
• https://t.me/cvenotify/32477 · Telegram Post
• https://t.me/cibsecurity/45050 · Telegram Post