Back
CVE-2023-0652
Local Privilege Escalation in Cloudflare WARP Installer (Windows)
High7.0EPSS 0.29%
- Published
- Updated
- Reserved
- Assigned by
- cloudflare
Description
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As Cloudflare WARP client for Windows (up to version 2022.5.309.0) allowed creation of mount points from its ProgramData folder, during installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| cloudflareCNA (assigner) | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.29% · top 78% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.
Weakness
Affected products
- affected ≤ 2022.5.309.0
References (3)
- https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release (opens in a new tab)x_transferred
- https://developers.cloudflare.com/warp-client/get-started/windows/ (opens in a new tab)x_transferred
- https://github.com/cloudflare/advisories/security/advisories/GHSA-xmhj-9p83-xvw9 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-0652)Record last updated .