PT-2022-21737 · Unknown · Warp Client

Mskowroncf + 1 · Published 2022-10-28 · Updated 2022-10-31 · CVE-2022-3320

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WARP Client (affected versions not specified)

Description The issue allows bypassing policies configured for Zero Trust Secure Web Gateway. This can be achieved by using the warp-cli command with the set-custom-endpoint subcommand and specifying an unreachable endpoint, which causes the WARP Client to disconnect. As a result, administrative restrictions on a Zero Trust enrolled endpoint can be bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-3320

GHSA-3868-HWJX-R5XF

Affected Products

Warp Client

References · 4

• https://osv.dev/vulnerability/CVE-2022-3320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3320 · Security Note
• https://github.com/cloudflare/advisories/security/advisories/GHSA-3868-hwjx-r5xf · Note
• https://t.me/cibsecurity/52202 · Telegram Post