CVE-2020-35152: cloudflare warp

csirt@kutim:~/threat-intel/cve/CVE-2020-35152

CVSS 7.8 · High EPSS 0,27%

Kerentanan Unquoted Search Path or Element pada cloudflare warp. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. Since version 1.2.2695.1, the vulnerability was fixed by adding quotes around the service's binary path. This issue affects Cloudflare WARP for Windows, versions prior to 1.2.2695.1.

Rincian

Terbit di NVD: 3 Februari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-428: Unquoted Search Path or Element
EPSS (30 hari): 0,27% peluang dieksploitasi; lebih tinggi dari 18,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cloudflare	warp	Semua versi sebelum 1.2.2695.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/cloudflare/advisories/security/advisories/GHSA-qc57-v5q8-f22h advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.