CVE-2023-0654

Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://developers.cloudflare.com/warp-client/	Product
https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cloudflare:warp:*:*:*:*:*:android:*:*

History

01 Sep 2023, 14:43

Type	Values Removed	Values Added
CWE		CWE-1021
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 3.7
References	~~(MISC) https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7 -~~	(MISC) https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7 - Third Party Advisory
References	~~(MISC) https://developers.cloudflare.com/warp-client/ -~~	(MISC) https://developers.cloudflare.com/warp-client/ - Product
CPE		cpe:2.3:a:cloudflare:warp::::::android::*
First Time		Cloudflare warp Cloudflare

29 Aug 2023, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-29 16:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-0654

Mitre link : CVE-2023-0654

CVE.ORG link : CVE-2023-0654

JSON object : View

Products Affected

cloudflare

warp

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2023-0654", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "cna@cloudflare.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.3}]}, "published": "2023-08-29T16:15:08.747", "references": [{"url": "https://developers.cloudflare.com/warp-client/", "tags": ["Product"], "source": "cna@cloudflare.com"}, {"url": "https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7", "tags": ["Third Party Advisory"], "source": "cna@cloudflare.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1021"}]}, {"type": "Secondary", "source": "cna@cloudflare.com", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.\n\n"}], "lastModified": "2023-09-01T14:43:59.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cloudflare:warp:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "B2EF7B54-01B4-4588-83EF-FD8261AB795E", "versionEndExcluding": "6.29"}], "operator": "OR"}]}], "sourceIdentifier": "cna@cloudflare.com"}