PT-2023-25982 · Cloudflare · Cloudflare Warp

Published 2023-09-07 · Updated 2023-09-13 · CVE-2023-3747

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloudflare WARP (affected versions not specified)

Description The issue allows an attacker with local access to a device to extend the maximum allowed disconnected time of the WARP client granted by an override code. This is possible due to a lack of server-side validation, which can be exploited by changing the date and time on the local device where WARP is running.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-602

CWE-565

Related Identifiers

CVE-2023-3747

Affected Products

Cloudflare Warp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-3747 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3747 · Vendor Advisory
• https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone · Note
• https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#retrieve-the-override-code · Note
• https://twitter.com/CVEnew/status/1699761510791233644 · Twitter Post
• https://t.me/cibsecurity/70065 · Telegram Post