CVE-2022-3337

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Weakness enumeration

CWE-862 CWE-290

Affected software

Vendor	Product	Versions
Cloudflare	WARP	< 6.15

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-vr93-4vx7-332pThird Party Advisory
https://github.com/cloudflare/advisories/security/advisories/GHSA-vr93-4vx7-332pThird Party Advisory

Timeline

Published: Oct 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-33385.4An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trig CVE-2022-33396.1A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially CVE-2022-33407.2XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE a CVE-2022-33415.3A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs b CVE-2022-33428.8The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLi CVE-2022-33433.5The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tr CVE-2022-33445.5A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a coop CVE-2022-33466.5DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-contr CVE-2022-33477.5DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-contr CVE-2022-33484.9Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific,CVE-2022-33496.8A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the co CVE-2022-33504.8The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege us