Security Resilience

CVE-2023-3747

Cloudflare Warp 6.29

Published
07 September 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0020 9th percentile
Risk Priority 41 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-3747 is a medium-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability in Cloudflare Warp. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure DesignA08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability Data

Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of…

more

server side validation, an attacker with local access to the device, could extend the maximum allowed disconnected time of WARP client granted by an override code by changing the date & time on the local device where WARP is running.

CWE(s)
CWE-602CWE-565

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1001.003 Protocol or Service Impersonation Command And Control
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1006 Direct Volume Access Stealth
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-1412Same product: Cloudflare Warp
CVE-2023-0238Same product: Cloudflare Warp
CVE-2023-0654Same product: Cloudflare Warp
CVE-2023-2754Same product: Cloudflare Warp
CVE-2023-1862Same product: Cloudflare Warp
CVE-2025-0651Same product: Cloudflare Warp
CVE-2023-0652Same product: Cloudflare Warp
CVE-2023-6193Same vendor: Cloudflare
CVE-2023-35885Shared CWE-565
CVE-2025-4820Same vendor: Cloudflare

Affected Assets

cloudflare
warp
6.29

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 partial match
blocks

Strong authentication mechanisms reduce reliance on unvalidated cookies for identity and access decisions.

PR.AA-04 partial match
blocks

Cookies commonly carry identity assertions; requiring their protection, conveyance, and verification directly eliminates the weakness.

PR.AA-05 partial match
blocks

Enforcing access policy and least privilege limits damage from cookie misuse but does not address cookie validation itself.

PR.DS-01 partial match
blocks

Integrity protections for data-at-rest can apply to cookie stores but do not cover validation during use.

PR.DS-02 partial match
blocks

Cryptographic integrity for data-in-transit directly mitigates tampering of cookies sent over the network.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.27 Learning from information security incidents partial match
removes
A.8.25 Secure development life cycle partial match
blocks

Secure development lifecycle mandates server-side validation and prevents reliance on client enforcement.

A.8.26 Application security requirements partial match
blocks

Application security requirements explicitly call for server-side enforcement of security mechanisms.

A.8.27 Secure system architecture and engineering principles partial match
blocks

Secure architecture principles discourage client-side trust but do not directly address this weakness.

A.8.28 Secure coding partial match
prevents

Secure coding standards require server-side checks and reject client-only enforcement.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect client-side enforcement but is not the primary mitigation.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-602, a class-level weakness, and none of its children carries one either.

References