PT-2023-16430 · Unknown · Warp Mobile Client

Ncabetecf · Published 2023-08-29 · Updated 2023-09-01 · CVE-2023-0654

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WARP Mobile Client versions prior to 6.29

Description The issue is due to a misconfiguration, making the WARP Mobile Client susceptible to a tapjacking attack. If an attacker installs a malicious application on a victim's device, they can trick the user into believing the app shown on the screen is the WARP client when, in reality, it is the attacker's app.

Recommendations For versions prior to 6.29, update to version 6.29 or later to resolve the issue. As a temporary workaround, consider restricting the installation of applications from unknown sources to minimize the risk of exploitation.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2023-0654

GHSA-5R97-PQV6-XPX7

Affected Products

Warp Mobile Client

References · 7

• https://osv.dev/vulnerability/CVE-2023-0654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0654 · Security Note
• https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7 · Note
• https://twitter.com/CVEnew/status/1696542188170068250 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1696592736286105601 · Twitter Post
• https://t.me/cibsecurity/69369 · Telegram Post
• https://developers.cloudflare.com/warp-client · Note