CVE-2022-4428

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-442806.5Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img.CVE-2022-442839.8AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.CVE-2022-442845.4Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).CVE-2022-442898.8Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.CVE-2022-44294.4Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial o CVE-2022-442909.8webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.CVE-2022-442919.8webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.CVE-2022-442947.2Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=.CVE-2022-442957.2Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.CVE-2022-442967.2Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=.CVE-2022-442979.8SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.CVE-2022-442989.8SiteServer CMS 7.1.3 is vulnerable to SQL Injection.