medium6.7
CVE-2022-3320
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand.
Impact
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restrictions on a Zero Trust enrolled endpoint.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cloudflare | Warp | before 2022.8.857.0 before 2022.8.861.0 before 2022.8.936 |