CVE-2023-3747: cloudflare warp
Vulnerability summary
CVE-2023-3747 is a medium (CVSS 5.5) vulnerability in cloudflare warp. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9% of scored vulnerabilities.
Timeline
- 07-09-2023PublishedVulnerability first disclosed.
- 26-09-2024Last modifiedVulnerability information updated.
Description
Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access to the device, could extend the maximum allowed disconnected time of WARP client granted by an override code by changing the date & time on the local device where WARP is running.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.20% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
- CWE-565Reliance on Cookies without Validation and Integrity CheckingThe product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Affected systems
Cloudflare2 products
- warp6.29
- warp client< 6.29
1 vendor · 2 products