CVE-2023-0654: Spoofing User's Activity Loads in WARP Mobile Client (Android)
First published: Tue Aug 29 2023(Updated: )
Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.
Credit: cna@cloudflare.com cna@cloudflare.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cloudflare WARP | <6.29 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-0654?
CVE-2023-0654 refers to a misconfiguration vulnerability in the WARP Mobile Client (< 6.29) for Android, which makes it susceptible to a tapjacking attack.
How does the misconfiguration in the WARP Mobile Client (< 6.29) for Android lead to a tapjacking attack?
The misconfiguration in the WARP Mobile Client allows an attacker to install a malicious application on a victim's device and trick the user into believing that the app shown on the screen is legitimate, while performing unauthorized actions in the background.
What is the severity of CVE-2023-0654?
CVE-2023-0654 has a severity rating of 3.9 (low).
How can I fix the CVE-2023-0654 vulnerability in the WARP Mobile Client?
To fix the CVE-2023-0654 vulnerability, users should update their WARP Mobile Client to version 6.29 or higher.
Where can I find more information about the CVE-2023-0654 vulnerability?
More information about the CVE-2023-0654 vulnerability can be found at the official Cloudflare Warp documentation and the Cloudflare security advisories page.
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/cloudflare
- canonical/cloudflare warp