Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2025-0651

Severity CVSS v4.0:
MEDIUM
Type:
CWE-269 Improper Privilege Management
Publication date:
22/01/2025
Last modified:
22/01/2025

Description

Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.<br /> <br /> User with a low system privileges  can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the &amp;#39;Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user.<br /> This issue affects WARP: before 2024.12.492.0.

Impact

Vector 4.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/R:U/RE:L/U:Green CVSS v4.0 Severity and Metrics:

Base Score: 6.10 MEDIUM
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/R:U/RE:L/U:Green

Attack Vector (AV): Local
Attack Complexity (AC): Low
Attack Requirements (AT): Present
Privileges Required (PR): Low
User Interaction (UI): Active
Confidentiality (VC): Low
Integrity (VI): High
Availability (VA): High
Confidentiality (SC): High
Integrity (SI): High
Availability (SA): High
Safety (S): Negligible
Recovery (R): User
Vulnerability Response Effort (RE): Low
Provider Urgency (U): Green

Base Score 4.0
6.10
Severity 4.0
MEDIUM

References to Advisories, Solutions, and Tools