CVE-2022-3337 — Lock WARP switch bypass by removing VPN profile on iOS mobile client

CVE-2022-3337

Lock WARP switch bypass by removing VPN profile on iOS mobile client PUBLISHED

Description (CNA)

It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.

Affected (CNA)

Vendor / product	Versions
Cloudflare / WARP	affected 0 before 6.15

CWE

CWE-862

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-vr93-4vx7-332p

ADP enrichment

CVE

No English description supplied.

https://github.com/cloudflare/advisories/security/advisories/GHSA-vr93-4vx7-332p

CISA-ADP

No English description supplied.

No references supplied.