« Back to list

CVE-2023-0238

Status: ModifiedMedium (5.5)—

Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on a victim's device to exploit a peculiarity in an Android function, wherein under certain conditions, the malicious app could dictate the task behaviour of the WARP app.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Cloudflare — Warp

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2023-0238",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-0238",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-30T17:35:13.806344Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@cloudflare.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.9,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@cloudflare.com",
      "affectedData": [
        {
          "vendor": "Cloudflare",
          "product": "WARP Client",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.29",
                  "status": "unaffected"
                }
              ],
              "version": "0",
              "lessThan": "6.29",
              "versionType": "patch"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-08-29T15:15:07.773",
  "references": [
    {
      "url": "https://developers.cloudflare.com/warp-client/",
      "tags": [
        "Product"
      ],
      "source": "cna@cloudflare.com"
    },
    {
      "url": "https://github.com/cloudflare/advisories/security/advisories/GHSA-23rx-f69w-g75c",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cna@cloudflare.com"
    },
    {
      "url": "https://developers.cloudflare.com/warp-client/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/cloudflare/advisories/security/advisories/GHSA-23rx-f69w-g75c",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@cloudflare.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on a victim's device to exploit a peculiarity in an Android function, wherein under certain conditions, the malicious app could dictate the task behaviour of the WARP app."
    },
    {
      "lang": "es",
      "value": "Debido a la falta de una política de seguridad, el Cliente Móvil WARP (&lt;=6.29) para Android era susceptible a esta vulnerabilidad, lo que permitía que una aplicación maliciosa instalada en el dispositivo de una víctima explotara una peculiaridad en una función de Android, en la que, bajo ciertas condiciones, la aplicación maliciosa podía dictar el comportamiento de las tareas de la aplicación WARP."
    }
  ],
  "lastModified": "2026-06-17T05:25:05.933",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudflare:warp:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2EF7B54-01B4-4588-83EF-FD8261AB795E",
              "versionEndExcluding": "6.29"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@cloudflare.com"
}