CVE-2023-0654: Spoofing User's Activity Loads in WARP Mobile Client (Android)
Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-0654?
CVE-2023-0654 refers to a misconfiguration vulnerability in the WARP Mobile Client (< 6.29) for Android, which makes it susceptible to a tapjacking attack.
How does the misconfiguration in the WARP Mobile Client (< 6.29) for Android lead to a tapjacking attack?
The misconfiguration in the WARP Mobile Client allows an attacker to install a malicious application on a victim's device and trick the user into believing that the app shown on the screen is legitimate, while performing unauthorized actions in the background.
What is the severity of CVE-2023-0654?
CVE-2023-0654 has a severity rating of 3.9 (low).
How can I fix the CVE-2023-0654 vulnerability in the WARP Mobile Client?
To fix the CVE-2023-0654 vulnerability, users should update their WARP Mobile Client to version 6.29 or higher.
Where can I find more information about the CVE-2023-0654 vulnerability?
More information about the CVE-2023-0654 vulnerability can be found at the official Cloudflare Warp documentation and the Cloudflare security advisories page.