CVE-2022-2225: Zero Trust Secure Web Gateway policies bypass using WARP client subcommands
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-2225?
CVE-2022-2225 is a vulnerability that allowed a user without admin privileges to bypass Zero Trust security policies and features in Cloudflare Warp.
How does CVE-2022-2225 impact Cloudflare Warp?
CVE-2022-2225 allows a user without admin privileges to bypass configured Zero Trust security policies and features such as 'Lock WARP switch' in Cloudflare Warp.
What is the severity of CVE-2022-2225?
The severity of CVE-2022-2225 is high, with a CVSS score of 7.8.
Which software versions are affected by CVE-2022-2225?
Cloudflare Warp versions up to 2022.5.227.0 for macOS, up to 2022.5.341.0 for Windows, and up to 2022.5.346 for Linux are affected by CVE-2022-2225.
How can I fix CVE-2022-2225?
Users should update Cloudflare Warp to a version higher than 2022.5.227.0 for macOS, 2022.5.341.0 for Windows, and 2022.5.346 for Linux to mitigate the vulnerability.