CVE Feed

    Dashboard / CVE / CVE-2023-1412

    CVE-2023-1412

    An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks (oplock) and symbolic links (which can both be created by an unprivileged user). After installing the Cloudflare WARP Client (admin privileges required), an MSI-Installer is placed under C:\Windows\Installer. The vulnerability lies in the repair function of this MSI. ImpactAn unprivileged (non-admin) user can exploit this vulnerability to perform privileged operations with SYSTEM context, including deleting arbitrary files and reading arbitrary file content. This can lead to a variety of attacks, including the manipulation of system files and privilege escalation. PatchesA new installer with a fix that addresses this vulnerability was released in version 2023.3.381.0. While the WARP Client itself is not vulnerable (only the installer), users are encouraged to upgrade to the latest version and delete any older installers present in their systems.

    Published:Apr 5, 2023
    Last Modified:Feb 10, 2025
    EPS:Apr 5, 2023
    EPSS Score:0.00107
    CVSS Score:7

    Affected Products

    Vendor
    Cloudflare
    Product
    Warp

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-0651 (CVSS 6.1) — Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with…
    CVE-2023-3747 (CVSS 5.5) — Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Overrid…
    CVE-2023-0654 (CVSS 3.9) — Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack.…
    CVE-2023-0238 (CVSS 3.9) — Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerab…
    CVE-2023-2754 (CVSS 7.4) — The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as…
    CVE-2023-1862 (CVSS 7.3) — Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp…
    CVE-2023-0652 (CVSS 7) — Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (…
    CVE-2022-4428 (CVSS 8.9) — support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed …
    CVE-2022-4457 (CVSS 5.5) — Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a …
    CVE-2022-3320 (CVSS 6.7) — It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High