CVE-2022-3322 MEDIUM

CVE-2022-3322: Lock WARP switch bypass on WARP mobile client using iOS quick action

Vendor Cloudflare
Product WARP
Weakness CWE-862 · Missing authorization
Published October 28, 2022
Last update May 5, 2025
View on NVD All CVEs

CVSS base score

6.7/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L

What the vulnerability does

01Description

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.

Key dates

02Disclosure timeline

October 28, 2022 CVE published
May 5, 2025 Record updated