Описание
It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.
Ссылки
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 6.15 (исключая)
cpe:2.3:a:cloudflare:warp_mobile_client:*:*:*:*:*:iphone_os:*:*
EPSS
Процентиль: 25%
0.00085
Низкий
6.7 Medium
CVSS3
8.5 High
CVSS3
Дефекты
CWE-862
CWE-290
EPSS
Процентиль: 25%
0.00085
Низкий
6.7 Medium
CVSS3
8.5 High
CVSS3
Дефекты
CWE-862
CWE-290