title: Cloudlfare WARP Arbitrary File Overwrite
description: Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.
problem types: CWE-20 Improper Input Validation
affected:
{
platforms: Windows
product: WARP
vendor: Cloudflare
versions:
lessThan: 2022.5.309.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
version: 3.1
]
solutions: Upgrade WARP client for Windows to the newest version (at least 2022.5.309.0.)